PRB: ASP Session Is Lost When You Use Cisco Local Director and SSL Session to Route (251027)

CAUSE

When you implement a Web farm that uses ASP session state, you must ensure that client requests are always routed back to the same Internet Information Server (IIS) computer so that session state is available. Currently, you cannot share session and application variables between IIS computers.

To deal with this, products such as Cisco Local Director can route client requests to the same IIS computer in a Web farm, based on either the client's Internet Protocol (IP) address or a Secure Sockets Layer (SSL) session identifier. If Local Director is behind a proxy or firewall, the client IP address may not be available, and using the SSL session identifier may be mandatory.

SSL sessions can be renegotiated at any time during a browser session. When this happens, a new "symmetric key" is generated and shared between the two computers in the conversation. Local Director sees the newly negotiated SSL session identifier, and the client requests are routed to a random server in the Web farm. If the client requests are routed to a different Web server in the farm, the existing ASP session values are lost, and a new ASP session is started.