For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

boneyard's avatar
boneyard
Icon for MVP rankMVP
Dec 11, 2014

issue with default server ssl profile, TCP RSTs send by BIG-IP

ok, weird situation, anyone seen this before?

 

virtual server listening on 443 with client and server SSL profile. when i use a debug profile (cipher: NONE:RC4+RSA) everything is fine. when i use the default ssl server profile parts of the website dont load. when i look at packet captures i see the BIG-IP is actively RSTing connections to the pool member with the defauls ssl server profile. this appears to happen when the response is larger then a few packets. so some of the traffic gets through, but not everything.

 

i assume the is some issue with the SSL on the pool member, but how can i explain that it works until the amount of data send by the pool member becomes "too" large? why does the big-ip send a reset on this?

 

the big-ip version is too low to enable reset packet logging :(

 

application delivery
LTM
management

2 Replies

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Jan 20, 2015

    this turned out to be related to:

    bug 224279 - Previously, if HTTP version responses were split across multiple packets, the connection could stall.  This issue has been corrected.

    which was caused by the client side BEAST mitigation based on (1/n-1) record splitting.