Forum Discussion
venkata_reddy_9
Nimbostratus
NimbostratusF5 LTM VE - Problem with IE7 SSL Passthrough
Hi ,
We are using BIG IP F5 LTM VE to load balancer to load balance a portal. When the requests are generated from any browser other than IE7 the portal is working fine. But when users try to access from IE7 it waits for a long time and displays "Page not found"
We are using SSL passthrough. we have setup iRule to display TCP connection status. When request is coming from IE7 CLIENT_ACCEPTED event is triggered and SERVER_CONNECTED is not getting triggered.
Can anyone suggest a way to debug and figure out the actual root cause for this behaviour?
Thank you,
Venkat
8 Replies
- nitass
Employee
is tcpdump helpful?
tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap \(host x.x.x.x and port xxx\) or \(host y.y.y.y and port yyy\)
x.x.x.x is virtual ip
xxx is virtual port
y.y.y.y is pool member ip
yyy is pool member port 
venkata_reddy_9thank you for the quick response.
Taken the TCP Dump and analyzed. SSL handshake is happening properly between Browser to Load Balancer but Load Balancer to the Node it is failing. Load balancer is sending [TCP Retransmission] Client Hello to the node and node is responding with duplicate acknowledgements [TCP Dup ACK 1417] https > 39753 [ACK] Seq=1503 Ack=1459 Win=9648 Len=0.- venkata_reddy_9thank you for the quick response.
Taken the TCP Dump and analyzed. SSL handshake is happening properly between Browser to Load Balancer but Load Balancer to the Node it is failing. Load balancer is sending [TCP Retransmission] Client Hello to the node and node is responding with duplicate acknowledgements [TCP Dup ACK 1417] https > 39753 [ACK] Seq=1503 Ack=1459 Win=9648 Len=0. - nitasshave you compared server-side clienthello between IE7 and others?
is there any different? wondering why node does not send serverhello when using IE7. - venkata_reddy_9Not any differet. looks like SSL passthrough issue.
- nitassdoes the IE7 issue happen when accessing portal directly (without F5)?
if not, i think it could have some different somewhere. please feel free to open a support ticket, so support would be able to find it out.
cheer! - venkata_reddy_9Portal opens fine when we bypass F5 and access it directly. Planning to open a support ticket.
HamishCirrocumulus
Is it possible that ie has been set to deny ssl if it doesnt trust the cert? Sometimes its set this way and if youre not presenting the full chain of certs then it will just present an error (and not a very good one either :)
H
