We have big time on this issue. any help appreciated.

Issue: The Clients login to our Site with username/password/storeId and get authenticated & will be able to order "something" using Order.aspx page. Intermittently, they get directed to login page while in order.aspx (and authenticated, working for some time).
Environment:
Web farm - 3 Web server load balanced (using Big-IP software-> http://ww.F5.com)
Session: Inproc [Big IP uses Sticky sessions to route the requests to same server where it had been first contacted]. We are pretty sure this works as we donot have issues with other applications on the same servers/load balancer.

So far, we have tried :
1. Tried all cases in :: http://support.microsoft.com/?id=910439
    Nothing seems to be problem.
2. Authentication Expiry:
set to 60 minutes, Sliding expiration=true (by default). Session expries in 26 hours. (just in case!)
3. Cookies: Client does not clear cookies, allow cookies (both Client/3rd Party)
   Size: does not matter, as we dont store anything in those cookies.
4. Called MSFT support:
     - tried Viewstate logger
     - tried Formsauthenticaiton logger
   found that the cookie is lost, so it redirects to login.aspx
5. We are trying to capture a netmon Network Log to help MSFT to see if it is our Network causing the packets to be lost.
 (I think it does not, as it works for 90% stores, only 10% get kicked out.) This happens even before the Forms Auth Timeout or Session Time out.

(FYI: All three servers have same Key on Machine.config (for encryption). And EnableViewStateMAC is set to false at the application level, so it does not look for decrypting Viewstate. This was done to avoid an error - viewstate corruption that was our initial trouble. We have rectified it, but not this issue.)

Not sure why it would lose the cookie. We donot have any ISAPI filters, no hardware that removes cookies. Stopped the Antivirus on the servers (suggested by MSFT - duh!) .whatelse...

We use Pass-through using POST i.e. they hit a link, the link POSTs username/secureKey/timestamp & we validate them in our side & do not ask for password again. - It does not matter as it is handled in ValidUser Method. After that it is standard for both logins.

Our code?
Login:
If ValidUser()
    FormsAuthentication.RedirectFromLoginPage(username , False)
else
   CheckforTyposAgain()


Order.aspx:

if not authenticated, Redirect to Login.aspx

Thanks a ton!

-Jay

Did u ever solve this problem?
Thanks