For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cf_525_pain_310's avatar
cf_525_pain_310
Icon for Nimbostratus rankNimbostratus
Feb 16, 2017

CloudFlare 525 Errors - f5 fix?

I recently started routing assets called via https through Cloudflare, a proxy service, amongst other things.   I have an interesting issue where, once i did that, i saw that around 1% of browser ...
BIG-IP
devops
iRules
security
cf_525_pain_310's avatar
cf_525_pain_310
Icon for Nimbostratus rankNimbostratus
Feb 17, 2017

  1. the cipher suites are compatible. I made comparisons and even matched CFs entire list and applied it to the f5s. didn't change the error condition

     

  2. SNI isn't being used. rather, none of the checkboxes or the server name field have any data. as an FYI, there are 3 websites/domains that go to this VIP, but they share one ssl cert with all 3 domain names in it. the cert I'm using does have all 3 domain names (san) in it.

     

  3. Yes and no. I tried but the nginx proxy isn't configured to handle that ssl traffic and would require other resources to do it, which I can do if necessary.

     

  4. There are some weird logs on the f5 that I see; but they don't seem to correlate with the 525s.

     

  • cf_525_pain_310's avatar
    cf_525_pain_310
    Icon for Nimbostratus rankNimbostratus
    Feb 17, 2017

    I actually split up the sites into 3 vips (all using the same ssl profile settings but I created 3 separate ssl client profiles) - specifically so that I could change up any ssl profile settings that were suggested, and only impact one site at a time (the least important one).

     

  • cf_525_pain_310's avatar
    cf_525_pain_310
    Icon for Nimbostratus rankNimbostratus
    Feb 17, 2017
    1. I noticed it right away. we actually saw a browser display that 525 error, then had trouble repro'ing it...it happens less than 1% of requests. but I have Catchpoint, I see a few of them in those automated tests each day and many on the cloudflare dashboard. so this could simply be exposing a preexisting condition that now manifests in a browser error. but, I wasn't seeing basic websites tests fail just trying to hit an https page this like does at times.