For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

lkchen's avatar
lkchen
Icon for Nimbostratus rankNimbostratus
Sep 15, 2008

HTTPS passthrough & fallback

Last night we had an outage of a service that is HTTPS passthrough to a pool of servers (with port translation).     When the outage continued this morning, it was time to see about putting...
application delivery
dev
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Sep 15, 2008
Hi Lawrence,

 

 

The rule checks whether the default pool configured on the virtual server has one or more available members before redirecting a request. Were you seeing the default pool marked green, while clients were still being redirected? If so, are you able to reproduce the issue during a maintenance window? You could try adding more logging to the rule to confirm the default pool name, how many active members there are and whether the pool is marked up while clients are redirected.

 

 

One scenario where I could see this happening is if a client makes a request while the pool is down, the pool comes back up and then the client continues to use the same TCP connection to make further HTTP requests (possibly if you have a proxy server in front of LTM). If this is the issue, you could add a TCP::close after the HTTP::redirect command. This will force the client to establish a new TCP connection for any subsequent request. When a new TCP connection is established to the VIP, the check of active members is re-run.

 

 

Aaron