Forum Discussion

sdavids5670_166's avatar
sdavids5670_166
Icon for Nimbostratus rankNimbostratus
Aug 07, 2014

Health check failing - tcp/54321 - is this more than a coincidence?

We are rolling out a new web application in a couple of weeks and the developers have noticed issues with the application that are very intermittent and difficult to quantify. Testers have reported ...
sdavids5670_166's avatar
sdavids5670_166
Icon for Nimbostratus rankNimbostratus
Aug 14, 2014

Here's what F5 support told our admin to do for the tcp/54321 issue. Since I do not know for which version this was applied, I would suggest that you contact F5 support if you're having this issue. The workaround could be different for your version.

 

"Here are the steps to work around this issue:

 

  1. Run the following commands to update your current iptables rules:
/sbin/iptables -D INPUT -p tcp --dport 54321 -j REJECT --reject-with icmp-port-unreachable /sbin/iptables -D INPUT -p tcp -m tcp --dport 54321 --tcp-flags ACK,SYN SYN -j REJECT --reject-with tcp-reset /sbin/iptables -A INPUT -p tcp -m tcp --dport 54321 --tcp-flags ACK,SYN SYN -j REJECT --reject-with tcp-reset

--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__--__

 

  1. Run the following commands to add the iptables rules to /config/startup. This will ensure that these iptables rules persist upon reboot and upgrades:
echo "/sbin/iptables -D INPUT -p tcp --dport 54321 -j REJECT --reject-with icmp-port-unreachable" >> /config/startup echo "/sbin/iptables -D INPUT -p tcp -m tcp --dport 54321 --tcp-flags ACK,SYN SYN -j REJECT --reject-with tcp-reset" >> /config/startup echo "/sbin/iptables -A INPUT -p tcp -m tcp --dport 54321 --tcp-flags ACK,SYN SYN -j REJECT --reject-with tcp-reset" >> /config/startup"
sdavids5670_166's avatar
sdavids5670_166
Icon for Nimbostratus rankNimbostratus
Aug 15, 2014
Dave, is your environment virtualized? Does your environment use TSO or has it been disabled? We had tons of health check fails (and even situations in which the heartbeat between the two F5s failed) and all of that disappeared (with the exception of the tcp/54321) when we turned off TSO on the F5s.