Forum Discussion

venkata_reddy_9's avatar
venkata_reddy_9
Icon for Nimbostratus rankNimbostratus
Sep 07, 2011

F5 LTM VE - Problem with IE7 SSL Passthrough

Hi ,

 

 

We are using BIG IP F5 LTM VE to load balancer to load balance a portal. When the requests are generated from any browser other than IE7 the portal is working fine. But when users try to access from IE7 it waits for a long time and displays "Page not found"

 

 

We are using SSL passthrough. we have setup iRule to display TCP connection status. When request is coming from IE7 CLIENT_ACCEPTED event is triggered and SERVER_CONNECTED is not getting triggered.

 

 

Can anyone suggest a way to debug and figure out the actual root cause for this behaviour?

 

 

Thank you,

 

 

Venkat

 

 

 

 

 

 

 

config
design
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Sep 07, 2011
    is tcpdump helpful?

     

     

    tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap \(host x.x.x.x and port xxx\) or \(host y.y.y.y and port yyy\)

     

    x.x.x.x is virtual ip

     

    xxx is virtual port

     

    y.y.y.y is pool member ip

     

    yyy is pool member port
  • venkata_reddy_9's avatar
    venkata_reddy_9
    Icon for Nimbostratus rankNimbostratus
    Sep 07, 2011
    thank you for the quick response.

     

     

    Taken the TCP Dump and analyzed. SSL handshake is happening properly between Browser to Load Balancer but Load Balancer to the Node it is failing. Load balancer is sending [TCP Retransmission] Client Hello to the node and node is responding with duplicate acknowledgements [TCP Dup ACK 1417] https > 39753 [ACK] Seq=1503 Ack=1459 Win=9648 Len=0.

     

     

  • venkata_reddy_9's avatar
    venkata_reddy_9
    Icon for Nimbostratus rankNimbostratus
    Sep 07, 2011
    thank you for the quick response.

     

     

    Taken the TCP Dump and analyzed. SSL handshake is happening properly between Browser to Load Balancer but Load Balancer to the Node it is failing. Load balancer is sending [TCP Retransmission] Client Hello to the node and node is responding with duplicate acknowledgements [TCP Dup ACK 1417] https > 39753 [ACK] Seq=1503 Ack=1459 Win=9648 Len=0.

     

     

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Sep 07, 2011
    have you compared server-side clienthello between IE7 and others?

     

     

    is there any different? wondering why node does not send serverhello when using IE7.
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Sep 10, 2011
    does the IE7 issue happen when accessing portal directly (without F5)?

     

     

    if not, i think it could have some different somewhere. please feel free to open a support ticket, so support would be able to find it out.

     

     

    cheer!
  • venkata_reddy_9's avatar
    venkata_reddy_9
    Icon for Nimbostratus rankNimbostratus
    Sep 11, 2011
    Portal opens fine when we bypass F5 and access it directly. Planning to open a support ticket.
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Sep 11, 2011
    Is it possible that ie has been set to deny ssl if it doesnt trust the cert? Sometimes its set this way and if youre not presenting the full chain of certs then it will just present an error (and not a very good one either :)

     

     

    H