Forum Discussion

Tom_Roche_93458's avatar
Tom_Roche_93458
Icon for Nimbostratus rankNimbostratus
Nov 21, 2014

how to get client-side debug output from Network Access Plugin?

I've been using the F5NAP as a client for ~2 years, after getting it setup on 64-bit linux, to run SSH sessions on a research compute cluster. However now I must make the F5VPN run through a jumpbox, which is not currently working: I can login to the remote access site from the F5NAPed firefox, and start the F5VPN, at which point I immediately lose all DNS. I'm guessing

  • The F5VPN is trying to push to my client a reference to a DNS server inside the firewall. I know from past experience that important hostnames (of, e.g., cluster login nodes) are only visible from the LAN or VPN.

  • This failure is whacking DNS on my client, because I observe the following repeatable sequence:

    1.  Start F5NAPed firefox on client (laptop, which remains 64-bit linux).
    1. Test 
      nslookup www.google.com
      from a console/terminal: succeeds.
    2. Login to remote-access site with F5NAPed firefox.
    3. Test 
      nslookup www.google.com
      : succeeds.
    4. Use remote-access site's web UI to start F5VPN.

    5. Test 

      nslookup www.google.com
      : fails with

      ;; connection timed out; no servers could be reached

      1. Use remote-access site's web UI to exit F5VPN (but leaving F5NAPed firefox up and logged-in to remote-access site).

      2. Test 

        nslookup www.google.com
        : succeeds.

  • The DNS push from the F5VPN is failing due to a routing problem, since the F5VPN worked before the imposition of the jumpbox tunnel.

However I see no way to debug this, since the F5VPN is implemented with a browser plugin. Is there some way to get status/debug output (e.g., stdout, stderr messages) from the F5NAP on linux, the way one could if running a console-based solution? E.g.,

  1. Can one make the F5NAP log to a file?
  2. Can one make the F5NAP log to the console from which one runs the F5NAPed firefox?
  3. Is there a recommended tool for observing relevant messages or other information from within firefox-3.x?
BIG-IP Access Policy Manager (APM)
debugging
nap
security
ssl vpn
vpn tunnel
  • Alexey_384's avatar
    Alexey_384
    Historic F5 Account
    Nov 21, 2014

    F5 logs are under ~/.F5Networks/. Also you should set log level to 63 in ~/.F5Networks/f5networks.conf

     

    • Tom_Roche_93458's avatar
      Tom_Roche_93458
      Icon for Nimbostratus rankNimbostratus
      Nov 21, 2014
      Tom Roche >> how to get client-side debug output from Network Access Plugin? Alexey > F5 logs are under ~/.F5Networks/. Also you should set log level to 63 in ~/.F5Networks/f5networks.conf @Alexey: Perhaps you are referring to server-side? Or to some other version of the F5NAP? Because I see no such directory or file on my client: me@client:~$ ls -ald ~/.F5* ls: cannot access /home/me/.F5*: No such file or directory me@client:~$ date ; find -type d -name '*F5*' ; date Fri Nov 21 10:19:26 EST 2014 ./.cache/mozilla/firefox/mwad0hks.default/Cache/2/F5 ./.cache/mozilla/firefox/mwad0hks.default/Cache/7/F5 ./.cache/mozilla/firefox/mwad0hks.default/Cache/F/F5 ./.cache/mozilla/firefox/mwad0hks.default/Cache/8/F5 ./.cache/mozilla/firefox/mwad0hks.default/Cache/5/F5 ./.cache/mozilla/firefox/mwad0hks.default/Cache/B/F5 ./.cache/mozilla/firefox/mwad0hks.default/Cache/D/F5 ./.cache/mozilla/firefox/mwad0hks.default/Cache/4/F5 ./.cache/mozilla/firefox/mwad0hks.default/Cache/9/F5 ./.cache/mozilla/firefox/mwad0hks.default/Cache/A/F5 ./.cache/mozilla/firefox/mwad0hks.default/Cache/C/F5 ./.cache/mozilla/firefox/mwad0hks.default/Cache/E/F5 ./firefox/firefox_for_F5_VPN Fri Nov 21 10:19:39 EST 2014 Note the latter directory is the special firefox profile I use only for my F5NAP'ed 32-bit firefox. It contains no `*.conf`: me@client:~$ find ~/firefox/firefox_for_F5_VPN -type f -name '*f5*' | wc -l 0 me@client:~$ find ~/firefox/firefox_for_F5_VPN -type f -name '*F5*' | wc -l 2 me@client:~$ find ~/firefox/firefox_for_F5_VPN -type f -name '*F5*' /home/me/firefox/firefox_for_F5_VPN/Cache/A8F5ACD9d01 /home/me/firefox/firefox_for_F5_VPN/extensions/{972ce4c6-7e08-4474-a285-3208198ce6fd}/plugins/np_F5_SSL_VPN.so Similarly, the `~/.cache/mozilla/` folders contain only the usual firefox cache binaries: me@client:~$ date ; find -type d -name 'F5' | xargs -i find {} -type f | wc -l ; date Fri Nov 21 10:21:11 EST 2014 19 Fri Nov 21 10:21:13 EST 2014 me@client:~$ date ; find -type d -name 'F5' | xargs -i find {} -type f ; date Fri Nov 21 10:21:27 EST 2014 ./.cache/mozilla/firefox/mwad0hks.default/Cache/2/F5/BFA05d01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/2/F5/BFA05m01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/2/F5/92D19d01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/7/F5/79B9Em01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/F/F5/DF5DDm01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/8/F5/F30B3d01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/8/F5/F30B3m01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/5/F5/6C567m01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/B/F5/F9D0Cm01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/B/F5/F9D0Cd01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/D/F5/88583m01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/4/F5/933F0d01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/9/F5/5E79Dm01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/9/F5/8635Cd01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/A/F5/FA65Bd01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/A/F5/0BA72m01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/C/F5/AA7D9d01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/C/F5/AA7D9m01 ./.cache/mozilla/firefox/mwad0hks.default/Cache/E/F5/B4B6Fm01 Fri Nov 21 10:21:28 EST 2014