HTTPS Problem

can you try Redirect Rewrite All under http profile?

What is your Server Side SSL set to in your VS?

 

 

Answer: No SSL Server Profile is selected = NONE

 

 

If you are not doing SSL on the Tomcat servers then you need to make sure it is set to None.

 

 

Answer: I am not performing an SSL setup to the Tomcat server in the pool.

 

 

When you look at your client profile drop down to advanced and what options are you customizing?

 

 

Answer: None, I have tried using both my own certificate and the default certificate

 

 

To troubleshoot this you need to keep in mind that it is not all one connection. You have an SSL connection coming to the VS on the F5 that is terminating and then the F5 will do its own socket to the server. So you need to troubleshoot each side independently, I would personally start with the client side (client to VS) and rule it out first before looking at the server side (VS to Tomcat server).

 

 

Client Side troubleshoot: Take a tcpdump on the F5 like Josh had stated, then run that through ssldump and see if the ssl handshake is completing successfully. ex: ssldump -r external.pcap If you want to decyrpt the session you will need to do this ssldump -d -A -k /config/ssl/ssl.key/(the name of the key for your site) -r external.pcap You basically want to confirm that the ssl handshake is completing and you see a GET request from the client. Another tool to use to troubleshoot the client side would Fiddler or HTTPWatch plugins for IE for Firefox, they will show you what the browser sees. From the server side, you keep saying you are seeing traffic in your wireshark trace, but what kind of traffic? Are you seeing a GET request to the web server? I ask because you should see traffic coming from the F5 in the form of whatever healthcheck you are doing on the pool to the web server, but that does not mean that it is actual client traffic. This should work, as simply doing an SSL VS is not something that is uncommon on an F5 device, I run roughly a dozen of them on some ASM units I manage.

 

 

Answer: This will take a little time to do, but I will try it. I did however perform a wireshart capture on the Tomcat server and it showed TCP connections to the F5.

can you try Redirect Rewrite All under http profile?

 

 

Answer: I need a little more information on how to perform this.

Would you please give me an example of using:

 

 

tcpdump -s0 -ni 0.0:nnn host and port 443 -w /var/tmp/external.pcap

 

can you create custom http profile similar to below and assign it to virtual server?

root@ve1100(Active)(/Common)(tmos) list ltm profile http myhttp
ltm profile http myhttp {
    app-service none
    redirect-rewrite all
}

root@f5-loadbalancer2(Active)(/Common)(tmos) list ltm profile http myhttp ltm profile http myhttp { app-service none redirect-rewrite all }

 

 

Syntax Error: "none" unknown property

 

 

root@f5-loadbalancer2(Active)(/Common)(tmos)

to create, can you try this?

root@ve1100(Active)(/Common)(tmos) create ltm profile http myhttp redirect-rewrite all

can you create custom http profile similar to below and assign it to virtual server?

 

 

Can you give me F5 GUI instructions. I executed the comand "create ltm profile http myhttp redirect-rewrite all" but I have no idea what it did or where the profile got stored.

it is under local traffic > profiles > services > http

Wahooooo ...

 

 

I found the myhttp profile and assigned it to my virtual server and petclinc is alive!

 

 

I've been chasing this one since noon Friday.

 

 

Would you please explain what I just did to make it work?

 

 

Thank you thank you,

 

 

Mark