Forum Discussion

sdavids5670_166's avatar
sdavids5670_166
Icon for Nimbostratus rankNimbostratus
Aug 07, 2014

Health check failing - tcp/54321 - is this more than a coincidence?

We are rolling out a new web application in a couple of weeks and the developers have noticed issues with the application that are very intermittent and difficult to quantify. Testers have reported ...
sdavids5670_166's avatar
sdavids5670_166
Icon for Nimbostratus rankNimbostratus
Aug 14, 2014

Here's what F5 support told our admin to do for the tcp/54321 issue. Since I do not know for which version this was applied, I would suggest that you contact F5 support if you're having this issue. The workaround could be different for your version.

 

"Here are the steps to work around this issue:

 

  1. Run the following commands to update your current iptables rules:
/sbin/iptables -D INPUT -p tcp --dport 54321 -j REJECT --reject-with icmp-port-unreachable /sbin/iptables -D INPUT -p tcp -m tcp --dport 54321 --tcp-flags ACK,SYN SYN -j REJECT --reject-with tcp-reset /sbin/iptables -A INPUT -p tcp -m tcp --dport 54321 --tcp-flags ACK,SYN SYN -j REJECT --reject-with tcp-reset

--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__

 

  1. Run the following commands to add the iptables rules to /config/startup. This will ensure that these iptables rules persist upon reboot and upgrades:
echo "/sbin/iptables -D INPUT -p tcp --dport 54321 -j REJECT --reject-with icmp-port-unreachable" >> /config/startup echo "/sbin/iptables -D INPUT -p tcp -m tcp --dport 54321 --tcp-flags ACK,SYN SYN -j REJECT --reject-with tcp-reset" >> /config/startup echo "/sbin/iptables -A INPUT -p tcp -m tcp --dport 54321 --tcp-flags ACK,SYN SYN -j REJECT --reject-with tcp-reset" >> /config/startup"
DSS_Gateway_158's avatar
DSS_Gateway_158
Icon for Nimbostratus rankNimbostratus
Aug 14, 2014
Hi David, Good to hear you had success, F5 have given us the same commands to try. I am not sure our issue is exactly the same as for 7 monitor fails, only 1 of those used 54321 for all 5 attempts. We are seeing random src ports which the F5 gives port unreachable, then a 54321 port unreachable just appears which wasn't even part of the TCP conversation.