Forum Discussion

muntae_kim's avatar
Jan 11, 2024

Inquiry regarding connection delay after IP change on customer's web server

hello. My name is Muntae Kim.
A customer inquired about delays occurring after changing the IP of the web server. We tried the previously resolved method, but it was ineffective, so we are writing a post and asking for your confirmation.

Product Name: BIG-IP i15800
Module name used: DDoS
Version information: BIG-IP Build 0.50.5 Engineering Hotfix
HW information:

1. Additional inquiries regarding delays when connecting to the internal web server for the first time
- Recently, the [] server and the [] server were merged with the same IP, so the existing Virtual Server rules were set to be used together.
- The structure used before is the same, but only the IP has changed.
- Problem solved by changing to Generate After Access on October 5, 2021
- Security ›› Bot Defense: This was resolved by changing www-cafe24-bot profile -> Browsers -> Device ID Mode to Generate [Before] Access → Generate [After] Access in Bot Defense Profiles, but this time, another cause occurred. Delays are expected to occur due to
- The following is the weblog of the [webserver] server in the LVS - webserver structure.

[] - - [11/Jan/2024:15:13:47 +0900] "GET /TSPD/0853a021f8ab20008da153a52cba459997d15822279f2d1721f4f32c1ecb7be8b971b217ea8951b6?type=9
HTTP/1.1" 302 215 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ Safari/537.36" "0.007"

[] - - [11/Jan/2024:15:27:40 +0900] "GET /TSPD/?type=18 HTTP/1.1" 302 215 "" "Mozilla/5.0 (Windows NT 10.0; Win6
4; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ Safari/537.36" "0.003"

1. Is the TSPD/xxx request part of the request that is assumed to be from F5 to the backend? If so, it is assumed that a 302 is displayed and there is a delay. Please check if the scenario I am expecting is correct.
2. Please check if there are any settings or options to control GET /TSPD/* related requests from F5 to the backend.
3. If you disable the currently used Bot Defense profile -> Browsers -> Device ID Mode to None in Generate After Access, please check how much the defense rate will drop by dividing it into DDoS defense and GET/DOS.

If you have additional information needed to resolve the issue, please reply.

thank you


1 Reply