top of page

F5 OneConnect Mixing Sessions: When Keep-Alives Glue the Wrong Users Together

  • Aug 15
  • 2 min read
F5 BIG-IP network security troubleshooting lab
F5 BIG-IP · Techclick CLI troubleshooting lab
User A sees user B's cart. App team swears the app is fine. OneConnect is on the VIP.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on F5 BIG-IP for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

OneConnect reuses server-side connections. If the app binds session to the TCP connection, users mix. Tighten OneConnect or turn it off for that VIP.

Why this ticket shows up

OneConnect is a performance feature. It is unsafe for apps that are not HTTP-stateless on the server connection.

Symptoms operators actually see

  • Cross-user data

  • Only on this VIP

  • OneConnect profile attached

  • Happens more under load

CLI first — copy this block

Run these on the F5 BIG-IP device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

tmsh list ltm virtual VS-SHOP profiles
tmsh list ltm profile one-connect
tmsh show ltm profile one-connect oneconnect
tmsh show sys connection cs-server-addr 10.9.9.21

How to read that output

Many client connections sharing one server connection is OneConnect doing its job — and breaking a sticky app.

Triage order

  1. Confirm OneConnect on the virtual

  2. Reproduce with two test users

  3. Remove OneConnect from that virtual

  4. Retest carts

  5. Leave it on for static content VIPs

Classic traps

What you see

Real cause

Fix

Rewrite the whole app today

OneConnect is the mixer

Remove it

Disable persistence

That makes mixing worse

Wrong control

Blame a cookie

Server connection was reused

Look at OneConnect

Proof the ticket is closed

  • Two users stay isolated

  • OneConnect off on that VIP

  • No new cross-user tickets

Say this in an interview

Cross-user data on an F5 VIP makes me list profiles for OneConnect before I blame the app.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments


bottom of page