Persistence and Session Management
Persistence decides the next connection
Persistence keeps a client tied to the same service across separate TCP connections. It is configured on the LB vserver, and some deployments also set it at service level. Common types are Source IP, Cookie Insert, Cookie Rewrite, Cookie Hash, SSL Session ID, URL Passive, Rule, Destination IP, and Custom Server ID. Persistence has its own timeout, which is not the same as the vserver idle timeout or the HTTP keep-alive timeout. A persistence entry does not override health: if the selected service is down, the ADC selects another eligible service and may update the cookie.
Cookie modes
- Cookie Insert: the ADC inserts its own cookie, often named
NSC_plus the server cookie name. - Cookie Rewrite: the ADC rewrites the server's cookie so subsequent requests carry ADC-usable information.
- Cookie Hash: the ADC hashes an existing cookie value without inserting or rewriting it.
- Cookie Passive: the ADC uses the server cookie but does not modify it.
Cookie domain, path, Secure, and HTTPOnly attributes matter: a cookie scoped to the wrong path is not sent on later requests, and a Secure cookie is not returned over plain HTTP.
Worked example
An application sets JSESSIONID. Configure Cookie Insert with cookie name NSC_JSESSIONID and a 30-minute persistence timeout. On the first response, the ADC adds NSC_JSESSIONID; on the next request, the client returns it and the ADC routes to the same service. If that service's monitor marks it down, the ADC chooses another service, and the new response carries an updated cookie. If the application is accessed through a proxy that strips cookies, Cookie Insert silently stops providing stickiness; Source IP persistence may be a fallback, but many clients behind one proxy collapse onto one service.
Traps
Do not confuse persistence timeout with connection idle timeout. Do not use Cookie Insert for non-HTTP protocols. Source IP persistence is fragile behind NAT and load balancers. SSL Session ID persistence depends on session reuse and is not reliable for all clients. Persistence does not keep a client on a down service, and a persistence entry does not replace a monitor.