Re: PF and Foundry ServerIron load balancer - potential TIME_WAIT pro blem.

[Mike Frantzen <frantzen@w4g.org>]

> thanks for the info on this. From what is being said, with tcp.closed at 30s
> and interval at 10s I should see the TIME_WAIT state being removed after
> 30-40 seconds. This is not happening. I've left it all night and it's not
> going anywhere. This is while the ServerIron is still performing it's
> healthcheck - this entales 3 SYN packets transmitted, wait about 3 seconds
> for a response then send a RST when one is not received. Wait 4 seconds and
> resend the 3 SYN's.. this goes on and on and on

The timeout is updated every time a new packet is received.  If you
decrease that expiration timeout low enough to compensate for the
ServerIron's brokeness, you'll end up cutting off valid connections
too early.  I suppose that doesn't matter too much in the TIME_WAIT
state but you'll end up with more bogus log entries.

Why don't you just use a non-stateful rule for the ServerIron?
 
.mike