HTTP POST not working through F5

hi all,

 

 

had problem with our primary F5 about 2 weeks ago, URL's were very slow for a particular vlan. Our service provider advised to reboot the F5, after reboot URL's started working again fine apart from 2 websites out of 450! Upon investigating these particular 2 websites, I noticed that these sites are used only as HTTP POST requests (not GET)

 

 

I've tried a few things Protocol profile change from lan optimisation to tcp for the /32 Virtual Server. Made a customised HTTP Profile just added HTTP1.0 requests so the F5 compresses responses to HTTP1.0 even though I can only see 1.1 responses from the server, still no change. Capture below:

 

 

36295 2011-01-21 08:17:42.691665 10.66.27.193 10.210.168.92 TCP 9497 > http [SYN] Seq=0 Win=4380 Len=0 MSS=1460 WS=0 TSV=2811941550 TSER=0

 

36296 2011-01-21 08:17:42.692606 10.210.168.92 10.66.27.193 TCP http > 9497 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=98987221 TSER=2811941550 WS=0

 

36297 2011-01-21 08:17:42.692616 10.66.27.193 10.210.168.92 TCP 9497 > http [ACK] Seq=1 Ack=1 Win=4380 Len=0 TSV=2811941551 TSER=98987221

 

36298 2011-01-21 08:17:42.692626 10.66.27.193 10.210.168.92 HTTP POST /volbrokerstp/VolbrokerToDrkwSTP.jws [Packet size limited during capture]

 

36299 2011-01-21 08:17:42.693625 10.210.168.92 10.66.27.193 TCP http > 9497 [ACK] Seq=1 Ack=1369 Win=8208 Len=0 TSV=98987221 TSER=2811941551

 

36300 2011-01-21 08:17:42.704733 10.210.168.92 10.66.27.193 HTTP HTTP/1.1 500 Internal Server Error [Packet size limited during capture]

 

36301 2011-01-21 08:17:42.710464 10.66.27.193 10.210.168.92 HTTP Continuation or non-HTTP traffic[Packet size limited during capture]

 

36302 2011-01-21 08:17:42.749130 10.210.168.92 10.66.27.193 TCP http > 9497 [FIN, ACK] Seq=749 Ack=2454 Win=10944 Len=0 TSV=98987226 TSER=2811941569

 

36303 2011-01-21 08:17:42.749141 10.66.27.193 10.210.168.92 TCP 9497 > http [ACK] Seq=2454 Ack=750 Win=5128 Len=0 TSV=2811941607 TSER=98987226

 

36304 2011-01-21 08:17:42.759374 10.66.27.193 10.210.168.92 TCP 9497 > http [FIN, ACK] Seq=2454 Ack=750 Win=5128 Len=0 TSV=2811941618 TSER=98987226

 

36305 2011-01-21 08:17:42.760297 10.210.168.92 10.66.27.193 TCP http > 9497 [ACK] Seq=750 Ack=2455 Win=10944 Len=0 TSV=98987227 TSER=2811941618

 

 

As you can above, the Apache returns 500 error, as the POST that it receives is not what it expects. Sometimes the POST works 1 in 3 approx. This problem has only occurred since the F5 reboot, prior there were no issues for 6 months plus

 

 

running 6900 LTM

 

v10.2.0

 

 

help!