The application frequently logs out users when accessed through Avi Load Balancer

Products

• VMware Avi Load Balancer

Issue/Introduction

Application session times out when traffic flows through multiple service (Scaled Setup) engines in the NSX-T cloud

Environment

1. Avi Virtual service deployed in NSX-T cloud.
2. Service Engine group with a virtual service scale greater than or equal to two

Cause

Layer 2 Scale-Out: Source-Based Traffic Distribution

In a traditional Layer 2 scale-out deployment, Avi Vantage offers granular control over client traffic distribution to specific Service Engines (SEs). This control is primarily achieved through a hashing mechanism based on client attributes:

• Hashing Algorithm: Avi calculates a hash value based on either the client's source IP address or a combination of the source IP address and source port.

• Persistent Binding: This calculated hash value is then persistently bound to a specific Service Engine. This binding ensures that all subsequent traffic from the same client (identified by its source IP or source IP and port combination) is consistently directed to the same, previously selected, Service Engine for the lifetime of the connection or configured persistence.

• Direct Traffic Redirection: Avi Vantage directly manages the redirection of client traffic to the designated Service Engine.

NSX-T Cloud Deployments: Layer 3 Scale-Out and NSX-Managed Routing

When Avi Vantage is deployed within an NSX-T cloud environment, the scale-out mechanism operates at Layer 3, and the control over client traffic flow fundamentally shifts to NSX-T:

• Route Injection: For virtual services configured in an NSX-T cloud, Avi Vantage injects routes into the NSX-T routing tables. These routes specify the virtual service IP address with the Service Engine data interfaces as the next hops.

• NSX-T Controlled Forwarding: In this architecture, the NSX-T network fabric is responsible for deciding the forwarding path for client traffic destined for the virtual service. NSX-T's routing logic, based on its Distributed Routing capabilities, determines which Service Engine receives the client's packets.

• Loss of Avi Controller Over Traffic Redirection: Consequently, Avi Vantage does not have direct control over client traffic redirection in an NSX-T cloud. The decision of which Service Engine handles a specific client's traffic is made by NSX-T based on its routing policies and the injected routes.

Resolution

Create a new service engine group with below settings.

1. Navigate to Administration -> Cloud Resources -> Service Engine Group -> Create 
2. Active/Standby or (N+M)
3. IF the SE group is (N+M), the min scale should be set to 1
4. Move the Virtual Service to the newly created SE group.