With the newer Brocade ADX code versions (12.4G+), it is possible to alter the TCP profile settings that is associated with the Virtual Server.
Why Change the TCP Profile:
I have run into issues when there is slowness in data transfer between the client and the Brocade ADX. Usually, I have seen this happen under 2 configuration setting:
- CSW (Layer 7 rule is enabled)
- SSL is terminated on the Brocade ADX
When we enable CSW or terminate SSL on the Brocade ADX, it tends to act as a “Full Proxy” device with TCP stack for Client-Side connection and another TCP stack for Server-Side connection. Somehow this setting will result in sub-optimal performance.
A sample TCP Profile:
tcp profile CLIENT_TCP
tcp profile SERVER_TCP
SSH@vADX(config)#server virtual VS-220.127.116.11
SSH@vADX(config-vs-VS-18.104.22.168)#port http tcp-proxy CLIENT_TCP SERVER_TCP
“CLIENT_TCP” profile changes the TCP profile setting that is client facing and the “SERVER_TCP” profile changes the TCP profile setting that is server facing. We can utilize the same TCP profile settings for both client and the server side, if required.
Ideally, I would recommend using 12.4U code version with the following TCP profile:
tcp profile TCP-PROFILE
The last 2 options for “timestamp” and “sack” are provided in 12.4U code version and are not available in earlier code versions.
The TCP profile can also be altered at the SSL profile level as noted here.
ssl profile star.domain.com
In the above case, the TCP profile is added to the SSL profile and this will be attached to the Virtual Server. With newer code version, we can directly attach to the TCP profile to the Virtual Server’s port using the “tcp-proxy” keyword as illustrated earlier.