Forum Discussion

Allwyn_Mascaren's avatar
Allwyn_Mascaren
Icon for Cirrus rankCirrus
Dec 24, 2018

Getting a 503 only when using f5

HI

I am using an oracle application and everytime when going through f5 and generating a report I get an not authorized for the resource error msg.

However when going without f5 the application opens the report just fine.

In the pcap I saw an error 503 when going through f5 just once but I am not sure why this is happening as it works fine when not using f5.

Also the 503 happened only once, and I don't know if that's what causing the problem.

The browser opens a different application when opening the report, so I am thinking f5 does something over there: 

JW!jE @y
48J8Z|`6OPGET /hr/modules/com/hyperion/reporting/web/reportViewer/HRStudioWebLaunch.jsp?fr_id=2055375631&repository_uuid=000001675e2cc808-0000-a638-ac14031a&repository_mime_type=ID200 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: 172.x.x.x:19000
DNT: 1
Connection: Keep-Alive
Cookie: JSESSIONID=J0DJcbCb0gtQmLZ9bqpYmnkrt32b3Sb2BPmMk2ZQPynhMvF9vvc9!-1411460373; ORA_EPMWS_User=srikanth.puliga; ORA_EPMWS_Locale=en_US; ORA_EPMWS_AccessibilityMode=false; ORA_EPMWS_ThemeSelection=Skyros; ORA_EPMWS_timeZone=-240

Any ideas?

BIG-IP
security

1 Reply

Sort By
  • John_Huttley's avatar
    John_Huttley
    Icon for Employee rankEmployee
    Dec 25, 2018

    Hi, 503 is application gateway. Probably not related.

     

    I've had cases with BI tools that download java to the client.

     

    The java app then establishes a secondary connection that is not associated with the browser. See if java is running..

     

    To debug this you will need to capture the traffic.

     

    Set up SSLKEYLOGFILE

     

    https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/

     

    Setup wireshark to capture port 443, clear your cache and a get a good capture of working and non working cases. Unlike a pure httpwatch or HAR capture, you will see if there is unexpected traffic that might be coming from a side-loaded application. (though if its https, you can't decrypt it) --John