cancel
Showing results for 
Search instead for 
Did you mean: 

Issues with F5 load balancer

alfons_gonzalez
Active Participant
0 Kudos

Hi,

We are testing the deployment of a web load balancer (F5 networks) on a SAP Bi deployment (4.1 SP4 Patch 1 - Windows 64).

After its initial configuration following error appears after entering the credentials in the login page

"This page has expired. Enter your credentials and try again. (FWC00006)"

We have found a KBA note (2085065 - Error "This page has expired. Enter your credentials and try again. (FWC00006)" when logon CMC or BI Launch

Pad) that describes same error using apache AJP for loading balance purposes.

Situation described in the note does not match exactly our scenario (where balance is managed by F5, not an apache instance) so provided resolution can not be applied but I suspect that the root cause is similar (balancer is not able to manage the session).

Has anyone a prevuous experience with F5 & SAP BI Tomcat facing same error?

Thanks,

Accepted Solutions (1)

Accepted Solutions (1)

denis_konovalov
Active Contributor
0 Kudos


If you have created Tomcat cluster and balancing it with F5 - the note you found might still apply.
If tomcats are not clustered - then most likely you do not have proper Session persistence set on F5.
BOE web apps support source IP and cookie based session persistence.

The way to troubleshoot this type of issue is to collect HTTP trace and see how session is handled and when/how exactly the error comes from.

alfons_gonzalez
Active Participant
0 Kudos

Hi Denis,

Effectively the problem came from not having set properly the session persistence (allowing cookies) on F5. After network guys set up properly this setting BOE starts to work fine.

Our next headache (also linked with F5 and its SSL implementation) is the use of dswsbobje services (see attached pdf). Only QaaWs seems to work fine, but rest of client based on its use (CRE, Design Studio, BI Services) fails when trying to use it. What does make the difference amongst QaaWs and the others?

I have checked that URL test to call Session WSDL works fine

https://loadbalancer_hostname/dswsbobje/services/Session?wsdl

so where problems comes from? A note (2112344)  mentions a similar issue but its workaround seems not to work in our case.

Any idea?

denis_konovalov
Active Contributor
0 Kudos

does it work with F5, but with HTTP ?
If yes - you'll need to enable HTTPS connector in axis2.xml

alfons_gonzalez
Active Participant
0 Kudos

Good point, Currently F5 is configured to redirect all http requests to HTTPS, so I have not tested what does happens when SSL is disabled on the load balancer. We only tested that services worked fine when F5 is not used.

Our SSL implementation is done on F5, not in tomcat. Does take sense in such a case to enable HTTPS connector. I don't think so? (we did't it in case of BOE app and it does works)

Thanks a lot for your comments,

denis_konovalov
Active Contributor
0 Kudos

logically you're correct, if SSL is terminated on F5 - you shouldn't change conf on tomcat, but....
I'd still test if the problem is at that level or something else.
Since actual URL is https - it might still be needed to add transport to axis2.xml

alfons_gonzalez
Active Participant
0 Kudos

Hi,

After a further research I have found following interesting info in SAP Admin guide about load balancing and web services

http://help.sap.com/businessobject/product_guides/sbo41/en/sbo41sp4_bip_admin_en.pdf

Web Services applications are currently only supported with the following load balancer configurations:

1. Source IP address persistence.

2. Source IP and destination port persistence (available only on a Cisco Content Services Switch).

3. SSL persistence.

4. Cookie based session persistence.

We already set up F5 load balancer to manage cookie based session persistance to manage BOE app (I have not found any info about BOE load balancer support in the admin guide but our test demonstrate that it is required), but with this configuration only QaaWs does work (no support to Crystal Reports 7 Design studio / BI services). Maybe we need to use another load balancer configuration in such a case. We will test it soon.

Thanks,

Answers (2)

Answers (2)

Former Member
0 Kudos

Hi Alfons,


We are experiencing the same issues. Here is our configuration.


We are on BI 4.1 SP5 FP3, Red Hat Linux

2 tomcat servers clustered, with distributable tag added in web.xml

SSL enabled on tomcat

LB requests are coming in as 443 and the LB sends requests to port 8443 on tomcat server.

F5 is setup with Source IP address persistence and we also tried with SSL persistence.

We confirmed the session ID via the tomcat manager is the same on both tomcats.


When we bring one of the tomcat servers down that is primary while I am connected to BI launch pad, I get session expired error, or if I click on refresh again the report I have open it just sits refreshing.


What are we missing?

Can you please tell me what exact setting you have on F5 that is working for you and any suggestions you have for our configuration.


Thanks, Rupa


denis_konovalov
Active Contributor
0 Kudos

Rupa ,

your issue is not due to F5, its due to limitations of tomcat cluster and BOE, see following KBA's

1748276 - BI 4.0 - Error: "Logon denied: Your session is not valid" in BI Launch Pad using Tomcat cluster

  2088195 - BI 4.1 - Error: "Logon denied: Your session is not valid" in BI Launch Pad using Tomcat cluster failover

Former Member
0 Kudos

Thanks Denis. I will look into these KB articles.

0 Kudos

Hi Rupa,

Have been successful with your issue? I have same problem and just checking if i can get some work around

Former Member
0 Kudos

Hi Alfons,

There are 3 points to take into consideration when implementing any load balancing solution:

  1. Sticky sessions - ensure that you are directed to the same Tomcat Server which created the login session token.
  2. URI Keepalive - ensure that if a server is dead/not responding then no further sessions are directed to that server
  3. Load Balancing algorithm - which Tomcat server should the F5 balance to when there are multiple sessions already active

To start with, confirm if the above 3 requirements are met.

-Sid