Forum Discussion
BenJ
Nimbostratus
NimbostratusApplication Web Pages Not Being Served Correctly by F5
Hi,
One of our customers has an application that doesn't appear to perform very well when load-balanced by the F5. The application is currently using a Standard VS profile, which is not doing SSL offload, uses cookie persistence and a SNAT pool with a single IP address and pretty much everything else is default. We have recently applied a Web Acceleration profile to the VS to attempt to address the problem but it doesn't appear to have solved anything. The WA profile is only set to cache and serve up static CSS and JS files.
The major issue, we believe, is that the client fails to receive some of the Javascript that is necessary for the page to render correctly. This was the case prior to the WA profile being applied as well as after.
The application used to be load-balanced, in a very rudimentary way, by iptables and these issues were not seen then. I'm very keen to find any clue as to where to look on the F5 for what could be causing the problem. I'm considering changing the profile to Perf L4 to see if it helps but there are two problems with that: 1. I don't get to learn what was causing the problem 2. I think the client wants to have the F5 do SSL offload in the near future
Any help would be greatly appreciated. Thanks in advance,
Ben
- Kevin_Stewart
Employee
A few thoughts:
-
One of the most prevalent "reverse proxy problems" is when an application doesn't understand that it's behind a reverse proxy and either serves up object references (images, JavaScript, style sheets, etc.) and redirect URLs with HTTP:// when the VIP is listening on HTTPS://, or the application serves up (absolute) object references for the server name that it thinks it is, versus the host name represented at the VIP. The easiest way to pin this down is to run a client side capture and see what the server is sending through the proxy.
-
Not nearly as likely, but still a possibility, there could be TCP-related (and/or possible HTTP profile settings) issues between the F5 and the server. Again, a capture is your best bet for troubleshooting this one.
-
What_Lies_Bene1Cirrostratus
I've certainly suffered issues around what Kevin describes in 1).
Just one thing to add, if you're not terminating the SSL on the F5 then cookie Persistence won't work. I'm not really sure a WA profile would either.
HamishCirrocumulus
BASE URL's in the code seem to be a particular favourite for some sites. The good news is that these can be fixed with a single rewrite... You really need to open the pages with firebug or similar and find the URI's that are failing. From there you can usually find where they are in the source stream and implement a suitable rewriting policy to cover them.
BenJHi guys,
Thanks for the suggestions. Just to clarify a couple of things: 1. The application doesn't actually use SSL, which is why there's no SSL termination 2. The problem is actually intermittent in that it's not a certain page that "always" fails to load properly and there's no way we've found to consistently reproduce the issue
It's quite difficult to troubleshoot in that respect. As I said, we think we've narrowed it down to a specific piece of Javascript that isn't being received at the client end...sometimes...and the result is that certain buttons on the app web page are greyed out rather than active.
If it helps, the application is written in Delphi and is being served up by IIS at the back end. It's an ugly application but it did seem to work OK behind iptables.
Any further thoughts most welcome.
Cheers, Ben.
As Kevin mentioned already, it could be caused on transport layer as well. If you have assigned a tcp-profile with 'nagle´s algorithm' enabled it could cause serious delays as the virtual server is 'collecting' data to fill a paket / segment to avoid signalling overhead. Switching to a lan_optimized_tcp profile or turning off 'nagle´s' may solve the problem without in-depth analysis.
Having a look at the object load times in a browser plugin as HTTPfox as recommended by Hamish may also help to figure out the problem.- BenJ
@Stephan: The VS is using the default TCP profile which doesn't have Nagle's enabled (I've double-checked). I'll have a look at switching to the lan-optimized profile. The capture process is a bit hamstrung unfortunately as the app is hosted for a different customer and we have to have them do the testing. They've not proven terribly adept at following instructions up to this point.
- That´s the advantage of a browser plugin (if you you have access to the site). PS: Going offline for today
- Hamish
If you enable request and response logging, do you ever see a request for the javascript failing? Or not being requested? (You could also get this from the access logs on the web server, but the bigip may be more useful if it breaks at the lb somehow)
Leo_54205Hi Benj,
Which LTM version is it? > 11 and HF? Do you have compression enabled?
Regards, Leo
- BenJ11.2.0 HF 4. No compression profile, but there is a WA profile that's caching .CSS and .JS files only.
king555_51103Hi, we have exactly the same problem. I turned off caching, compression and sets the default tcp profile, but problem remained. We use SSL on client and server side so troubleshooting is quite difficult. When client (browser) send request randomly some resources (like css, js, gif, ...) aren't transmitted. After defined period (default 300 s. Idle Timeout) BIG-IP send reset packet (TCP - RST, ACK) When problem occured request is not present in ASM log (full request and response logging is enabled) We use HA pair (active-pasive) release version 11.3 hotfix 7. Any ideas?- Leo_54205Hi, Could you post result of "tmsh list ltm virtual [name of your virtual server]" command? What is your hardware type? Leo.
