Forum Discussion
NimbostratusI-rule between VIPs on two different physical F5's
Hi All,
We have an i-rule which forwards request from F5 VIPA to F5 VIPB. VIPA is on F5 device in location A and VIPB is on another F5 device in location B.
VIPA: Bunch of servers under a pool, all listen on 80, the servers are in same location as of F5 VIPB: Bunch of servers under a pool
I-rule was written on VIPA to forward request either to VIPB or to it's own default pool.
when HTTP_REQUEST { set usessl 0 switch -glob [HTTP::path] { "/xyz/us/" - "/xyz/uk/" { snat xx.xxx.xxx.xxx set usessl 1 pool vipb-443} default { set usessl 0 pool defaultpool-80
} } } when SERVER_CONNECTED { if { $usessl == 0 } { SSL::disable } }
Pool vipb-443 has just one member that's VIPB with 443 port pool defaultpool-80 has bunch of servers in same location as of VIPA
I have a flow on a page hosted on VIPA which loads data from a page in VIPB and then comes back to pool members of VIPA for some other processing.The issue is when a http request is going thru this I-rule, the first part xyz/us that goes to VIPB is successful and in default path it throws error_inertnet_connection_reset.
The tcpdump shows that VIPA LTM sent a RST command to server(default pool member).
Any help would be greatly apprreciated.
6 Replies
Mohamed_LrhaziAltocumulus
what persistence is applied to the VIP?I would guess that the SSL disable is happening too late.
I would try the third example is this post https://devcentral.f5.com/wiki/iRules.ssl__disable.ashx
From the post .... Note: Disabling SSL on the serverside only applies before serverside connection has been established (SERVER_CONNECTED) or when the clientside of the connection is in a detached state (e.g., oneconnect, LB::detach).
Ravi9_136822Thank you, will try the 3rd option and post the out come here- Ravi9_136822No luck. The first call to Intial page load on VIPA itself failed with error internet connection reset error
- Ravi9_136822Source Address Persistence
- Ravi9_136822
Here is the solution, we added snat in default path as well. Snat to local ip of load balancer, that resolved the issue.
