Forum Discussion

Korai_331784's avatar
Korai_331784
Icon for Altostratus rankAltostratus
Sep 26, 2018

Host Refused connection - Passing through F5

Hi,

 

we have host sitting inside and refusing http/https connections from outside. we can telnet it from outside (internet) on port 443 bit when we run command https:// then not getting anything and if do telnet then gets connection refused from host.

 

I have standard virtual server with external vip pointed to inside host ip B.B.B.B

 

I have SNAT on external VS for outside communication. so flow is like below

 

telnet A.A.A.A port 80 trying A.A.A.A.... connected to A.A.A.A Escape character is '^]' GET /HTTP/1.1

 

connection closed by foreign host.

 

Is there anything i am missing on VS setup or any other suggestion ot recommendations please

 

BIG-IP
LTM
security
Super-NetOps
  • svs's avatar
    svs
    Icon for Cirrostratus rankCirrostratus
    Sep 26, 2018

    It's really hard to help you, if you don't provide the least of information about your configuration. Could you please add the output of the following tmsh commands:

    list ltm virtual 
list ltm pool

    BTW your HTTP request is not valid (maybe that's the reason why the BIG-IP denies your request). A correct HTTP/1.1 request use spaces and needs a host header.

    GET / HTTP/1.1
Host: www.example.com

    An HTTP/1.1 without host header does not comply with RfC and the BIG-IP silently drops or resets those requests.

  • AhmedGalal219_3's avatar
    AhmedGalal219_3
    Icon for Nimbostratus rankNimbostratus
    Sep 26, 2018

    if you installed a http profile you must configure SSL offloading. could you provide with VS configuration??

     

  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Sep 26, 2018

    Hi,

     

    first of did you set up ssl interception?

     

    if yes, you need a ssl client profil and ssl server profil (if your backend listen in ssl/TLS port). you need also http profil in this case.

     

    If no, you don't need HTTP profil, ssl server or client profil.

     

    Last point if you have a cluster check that your floating IP have access to your backend, because monitoring is done with self IP and you can have a green monitoring and can't access to your service if you don't open flow with floating IP as source.

     

    regards

     

  • Korai_331784's avatar
    Korai_331784
    Icon for Altostratus rankAltostratus
    Sep 27, 2018

    ltm virtual vs_out_abc.co.nz_http { destination X.X.X.X:http ip-protocol tcp mask 255.255.255.255 pool pl_out_abc profiles { http-wan-optimized-compression { } tcp-wan-optimized { } } snatpool pl_snat_out_inet vlans { Outside } vlans-enabled } root@F5(Active)(tmos) list ltm pool pl_out_abc ltm pool pl_out_abc { members { A.A.A.A:http { session monitor-enabled } A.A.A.A:https { session monitor-enabled } B.B.B.B:https { session disabled } } monitor https } root@F5(Active)(tmos)

     

    Tried as above with header getting same error