For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Scott_85521's avatar
Scott_85521
Icon for Nimbostratus rankNimbostratus
Oct 07, 2008

Firefox not playing

Hi Guys,

 

I've come across a problem with a VIP today, where firefox randomly decided to get an application error page, here is the scenario:

 

 

-Connect to the Internal Application VIP; works fine

 

-Connect to the Internet VIP; Problem.

 

 

The latter VIP is more complicated than the Internal VIP, having multiple classes switching and re-writing traffic based on URI, and a number of iRules, some doing 302 rewrites and others handling error codes. Another triggers on CLASS_SELECTED to determine the persistence mode.

 

 

Soon we plan to add Web Accelerator into the mix (currently held back due to a bug in 9.4.4HF1, upgrade pending)

 

 

So, what's was the problem with the Internet VIP you may ask? It seems that Firefox was constantly directed to the wrong Application Servers, this did not affect IE or Safari users, only Firefox.

 

 

Is there anything under the hood on the f5 that may pick on certain User-Agents, especially considering the HTTP Class and iRule use on this VIP? If not has anything like this been seen before, or are there any other ideas?

 

 

Thanks,

 

 

 

Scott-
config
design

1 Reply

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Oct 07, 2008
    Hi Scott,

     

     

    Can you post an anonymized copy of the VIP, HTTP class, HTTP profile and pool configuration (using b VIP_NAME list, b profile httpclass CLASS_NAME list, b profile http HTTP_PROFILE_NAME list, etc)? Are you using an HTTP class to select a pool? I assume you're not using ASM if you're planning on using Web Accelerator.

     

     

    Are you able to reproduce this? If so, I think it would be helpful to capture a tcpdump of the client and server side traffic. If you can get one trace of a successful request and one trace of a failed request, it would help. If you haven't used tcpdump before, there are a couple of solutions on AskF5 you can check:

     

     

    SOL411: Overview of packet tracing with the tcpdump utility

     

    https://support.f5.com/kb/en-us/solutions/public/0000/400/sol411.html

     

     

    SOL6546: Recommended methods and limitations for running tcpdump on a BIG-IP version 9.x system

     

    https://support.f5.com/kb/en-us/solutions/public/6000/500/sol6546.html

     

     

    You can use syntax like the following to run the trace:

     

     

    tcpdump -ni 0.0 -s0 -w/var/tmp/`/bin/hostname`.FF_working.dmp host CLIENT_IP or host SERVER_IP

     

     

    tcpdump -ni 0.0 -s0 -w/var/tmp/`/bin/hostname`.FF_breaking.dmp host CLIENT_IP or host SERVER_IP

     

     

    If you need help analyzing the tcpdumps, you can open a case with F5 Support.

     

     

    Aaron