F5 LTM as Reverse Proxy

Checked SSL dump traffic via command line at LB and found that handshake is being done between both LB instances (PROXY-LB and int-LB) but final RST packet seen

who sends reset? if it is bigip, can you try this?

sol13223: Configuring the BIG-IP system to log TCP RST packets

Okay, so given your architecture:

Internet --> Ext FW --> F5 LB doing Proxy --> Int FW --> F5 LB --> Pool Member

I'm guessing that you're terminating SSL at the external LB, re-encrypting, and then decrypting again at the internal LB? In which case your internal FW is simply forwarding SSL traffic? Have you assessed that non-SSL traffic works? Do you see traffic on both sides of both VIPs?

For what it's worth, I wasn't suggesting you remove the external firewall, but rather the one after the proxy LB (internal FW).

Internet --> Ext FW --> F5 LB doing Proxy --> Pool Member

the below is the output

where C -- means - Proxy LB,,,, S -- means internal LB and this I believe monitor (polling) traffic.

ssldump -nr /var/tmp/AIA_8002_proxy_issue.pcap

1 1 0.0009 (0.0009) C>S Handshake

  ClientHello
    Version 3.1
    cipher suites  
    ---------------------------------
    compression methods
            unknown value
              NULL

1 2 0.0009 (0.0000) S>C Handshake

  ServerHello
    Version 3.1
    session_id[32]=
      a3 0f 9f 8f 73 b1 d6 39 a6 7c 37 ef 51 a9 67 b8
      30 d0 05 23 db 0d 47 e3 34 f5 17 73 81 57 d5 82
    cipherSuite         TLS_RSA_WITH_RC4_128_SHA
    compressionMethod                   NULL

1 3 0.0009 (0.0000) S>C Handshake

  Certificate

1 4 0.0009 (0.0000) S>C Handshake

  ServerHelloDone

1 5 0.0023 (0.0014) C>S Handshake

  ClientKeyExchange

1 6 0.0023 (0.0000) C>S ChangeCipherSpec

1 7 0.0023 (0.0000) C>S Handshake

1 8 0.0044 (0.0020) S>C ChangeCipherSpec

1 9 0.0457 (0.0412) S>C Handshake

1 10 0.0467 (0.0010) C>S application_data

1 0.0485 (0.0017) S>C TCP RST

above exchange shows... From Client (Proxy LB) to Server (int LB) reachable

RST could be because of the this is monitor traffic so after exchange it RST the packet.

but why the POOL shows down then ?

The "application_data" in the capture indicates that the SSL handshake is probably okay. Can you remove the monitor until you have data flowing correctly? With the monitor removed, now look on the server side of the internal LB for traffic. Do you see data flowing to the server? Do you see either party reset the connection?

I have removed the Monitor, but the Proxy LB (POOL) is still do not work. Need to raise F5 ticket...

So just to level set, is this how you have it configured?

- Client passes request through the external FW to the external LB VIP (defined IP and port)
- External VIP passes traffic to a pool, which is a VIP on the internal LB (through the internal FW)
- Traffic arrives at internal LB VIP and is then passed to a pool, which is the web server(s)  

If this is correct, where do you NOT see traffic?

• client to external LB VIP?
• external LB to internal LB VIP?
• internal LB to server?