
F5 OneConnect Mixing Sessions: When Keep-Alives Glue the Wrong Users Together
- Aug 15
- 2 min read

User A sees user B's cart. App team swears the app is fine. OneConnect is on the VIP.
This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.
What you will be able to do
Name the first CLI command to run on F5 BIG-IP for this ticket
Separate the layer that is actually broken from the layer people blame
Apply one scoped fix instead of a global disable
Prove the ticket closed with a session, log, or counter
Quick answer
OneConnect reuses server-side connections. If the app binds session to the TCP connection, users mix. Tighten OneConnect or turn it off for that VIP.
Why this ticket shows up
OneConnect is a performance feature. It is unsafe for apps that are not HTTP-stateless on the server connection.
Symptoms operators actually see
Cross-user data
Only on this VIP
OneConnect profile attached
Happens more under load
CLI first — copy this block
Run these on the F5 BIG-IP device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.
tmsh list ltm virtual VS-SHOP profiles
tmsh list ltm profile one-connect
tmsh show ltm profile one-connect oneconnect
tmsh show sys connection cs-server-addr 10.9.9.21How to read that output
Many client connections sharing one server connection is OneConnect doing its job — and breaking a sticky app.
Triage order
Confirm OneConnect on the virtual
Reproduce with two test users
Remove OneConnect from that virtual
Retest carts
Leave it on for static content VIPs
Classic traps
What you see | Real cause | Fix |
Rewrite the whole app today | OneConnect is the mixer | Remove it |
Disable persistence | That makes mixing worse | Wrong control |
Blame a cookie | Server connection was reused | Look at OneConnect |
Proof the ticket is closed
Two users stay isolated
OneConnect off on that VIP
No new cross-user tickets
Say this in an interview
Cross-user data on an F5 VIP makes me list profiles for OneConnect before I blame the app.
Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/



Comments