For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

rjones_01_14578's avatar
rjones_01_14578
Icon for Nimbostratus rankNimbostratus
Sep 20, 2016

Keep Connection open on redirect

I have a 443 VS that keeps the connections open and reuse them when needed. I have a 80 VS that redirects to 443 but it always closes the connection after each connection. How can I keep the connection open when going to 80 and redirecting to 443? I have a simple redirection iRule

 

when HTTP_REQUEST {

 

HTTP::respond 301 Location "https://[HTTP::host][HTTP::uri]"

 

}

 

curl -IL https://clients.F5.com

 

HTTP/1.1 302 Found

 

Cache-Control: private

 

Content-Length: 162

 

Content-Type: text/html; charset=utf-8

 

Location: https://clients.f5.com//login/default.aspx

 

X-Frame-Options: SAMEORIGIN

 

Strict-Transport-Security: max-age=31536000

 

Set-Cookie: F5Sess=srjdlx4kzsu3jgodl4vnxmim; path=/; secure; HttpOnly

 

X-Powered-By: ASP.NET

 

Strict-Transport-Security: max-age=31536000

 

SERVER:

 

Date: Tue, 20 Sep 2016 19:13:13 GMT

 

HTTP/1.1 301 Moved Permanently

 

Cache-Control: private

 

Content-Length: 165

 

Content-Type: text/html; charset=utf-8

 

Location: https://login.F5.com/en-us/login/Default.aspx

 

X-Frame-Options: SAMEORIGIN

 

Strict-Transport-Security: max-age=31536000

 

Set-Cookie: F5Sess=me5sjh4v4mdnobkbnx24iryy; path=/; secure; HttpOnly

 

X-Powered-By: ASP.NET

 

Strict-Transport-Security: max-age=31536000

 

SERVER:

 

Date: Tue, 20 Sep 2016 19:13:13 GMT

 

HTTP/1.1 200 OK

 

Cache-Control: private

 

Content-Length: 49534

 

Content-Type: text/html; charset=utf-8

 

X-Frame-Options: DENY

 

Set-Cookie: F5LoginSess=; expires=Mon, 19-Sep-2016 19:13:14 GMT; path=/; secure; HttpOnly

 

Set-Cookie: ASP.NET_SessionId=; expires=Mon, 19-Sep-2016 19:13:14 GMT; path=/; secure; HttpOnly

 

Set-Cookie: F5Sess=; expires=Mon, 19-Sep-2016 19:13:14 GMT; path=/; secure; HttpOnly

 

Set-Cookie: F5ConnSess=; expires=Mon, 19-Sep-2016 19:13:14 GMT; path=/; secure; HttpOnly Date: Tue, 20 Sep 2016 19:13:13 GMT

 

curl -IL clients.F5.com

 

HTTP/1.0 301 Moved Permanently

 

Location: https://clients.F5.com/

 

Server: BigIP

 

Connection: Keep-Alive

 

Content-Length: 0

 

HTTP/1.1 302 Found

 

Cache-Control: private

 

Content-Length: 162

 

Content-Type: text/html; charset=utf-8

 

Location: https://clients.F5.com//login/default.aspx

 

X-Frame-Options: SAMEORIGIN

 

Strict-Transport-Security: max-age=31536000

 

Set-Cookie: F5Sess=qc0yfggejzly1lukn5daw2qg; path=/; secure; HttpOnly

 

X-Powered-By: ASP.NET

 

Strict-Transport-Security: max-age=31536000

 

SERVER:

 

Date: Tue, 20 Sep 2016 19:15:25 GMT

 

Connection: close

 

HTTP/1.1 301 Moved Permanently

 

Cache-Control: private

 

Content-Length: 165

 

Content-Type: text/html; charset=utf-8

 

Location: https://login.F5.com/en-us/login/Default.aspx

 

X-Frame-Options: SAMEORIGIN

 

Strict-Transport-Security: max-age=31536000

 

Set-Cookie: F5Sess=owdyyxsu4lrzx1ousa4uyspe; path=/; secure; HttpOnly

 

X-Powered-By: ASP.NET

 

Strict-Transport-Security: max-age=31536000

 

SERVER:

 

Date: Tue, 20 Sep 2016 19:15:25 GMT

 

Connection: close

 

HTTP/1.1 200 OK

 

Cache-Control: private

 

Content-Length: 49534

 

Content-Type: text/html; charset=utf-8

 

X-Frame-Options: DENY

 

Set-Cookie: F5LoginSess=; expires=Mon, 19-Sep-2016 19:15:25 GMT; path=/; secure; HttpOnly

 

Set-Cookie: ASP.NET_SessionId=; expires=Mon, 19-Sep-2016 19:15:25 GMT; path=/; secure; HttpOnly

 

Set-Cookie: F5Sess=; expires=Mon, 19-Sep-2016 19:15:25 GMT; path=/; secure; HttpOnly

 

Set-Cookie: F5ConnSess=; expires=Mon, 19-Sep-2016 19:15:25 GMT; path=/; secure; HttpOnly

 

Date: Tue, 20 Sep 2016 19:15:25 GMT

 

Connection: close

 

application delivery
BIG-IP
iRules

3 Replies

  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Sep 20, 2016

    Who is sending the TCP connection close FIN flag ? Client or F5 ? You should be able to identify this by doing a tcpdump. I am guessing the client browser is closing the connection once a redirect is received.

     

  • tatmotiv's avatar
    tatmotiv
    Icon for Cirrostratus rankCirrostratus
    Sep 21, 2016

    Why would you want to keep the tcp connection to port 80 open after the redirect? In most cases (if the service is configured properly), there will not be any further http requests to port 80 as the redirection already has happened. All subsequent requests should go to port 443, which of course can only be handled in a separate tcp connection due to the changed destination port.

     

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Sep 21, 2016

    Hi Rjones,

    there is no relationship between the HTTP and HTTP Virtual Servers. You can savely close the connection on HTTP without getting any side effecs for the subsequent HTTPS request.

    I guess its just CURL that tricks you out and send slightly different request for 

    curl -IL https://clients.F5.com
    and 
    curl -IL clients.F5.com
    .

    You could issue a 

    curl -v -IL https://clients.F5.com
    and 
    curl -v -IL clients.F5.com
    to see any differenced in CURLs request headers.

    Cheers, Kai