Forum Discussion

Hamish's avatar
Hamish
Icon for Cirrocumulus rankCirrocumulus
Feb 28, 2014

No Reply from VMWare View broker...

Has anyone out there experienced a similar issue? I'm testing 11.4.1HF3 and 11.5.0 for a replacement APM installation. The APM works fine for Citrix (No web interface, the webtop is configured for citrix remote desktops).

 

When I put VMWare View remote desktops on the webtop, the citrix still works, but the VMWare View ones showup as a broken icon. Looking at the traffic between APM and the VMWare brokers, we see the request sent, and then the connection closes... Using the exact same request via curl (From the APM server) results in the XML response coming back correctly...

 

Anyone got any idea what the VMWare View broker is expecting? Literally the only thing different between curl (Working) and APM (Not working, is the User Agent, accepts and Content-Type headers... But I can't believe I'm the only one as F5 Supporta re yet to find any errors in my config... (And it's not like the deployment guides for VMWare View are any more involved than Citrix or ahave anythign ultra special in them).

 

This isn't a problem with the PCoIP traffic. We can't even get that far. It's the initial request from Client to Broker that's failing..

 

H

 

BIG-IP Access Policy Manager (APM)
cloud
deployment
design
security
virtualization
vmware

15 Replies

Sort By
Show More
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Mar 03, 2014
    1. Yes
    2. Not exactly. I have a webtop. Up till friday the view connection broker wouldn't respond. By adding in client certs to a new the server_ssl profile it started to respond. Might have been VMWare config perhaps (We got strange cert auth errors until I did that. Maybe it was SSL level negs. Same request worked fine with curl, UNLESS you disabled TLS (i.e. would;t work with SSLv2 or SSLv3). Since Saturday (Change of server_ssl profile), the broker works. HOWEVER it only works for HTML5 client. Not for Horizon View from web top (Connection opens and the VDI RESETS (tcp reset) the connection to APM after about 150ms.
    3. That's correct. A SNAT pool doesn't work. It doesn't matter WHAT I specify for SNAT. The BigIP's selfip is ALWAYS used (There is no floating selfip the APM is stand-alone currently. Will be 3 of them load-balanced by GTM eventually).
    4. Any cert. I'm going to play more. It may be tied to versions of SSL enabled on the profile. But VMWare doesn't log WHY it closes connections. It just does... Grr..

    Note. I don't believe this is an APM problem now (Except in as far as a config error at APM could be causing it, but the lack of logs from VMWare explaining WHY it's closing the connection is... annoying...

     

    We're getting closer... Different connections closing now... But the connection broker works...

     

  • Andrey_Terentye's avatar
    Andrey_Terentye
    Historic F5 Account
    Mar 03, 2014

    Thanks for this information.

     

    It looks like there are several problems here:

     

    1. SNAT pool is not working
    2. Horizon View client time outs establishing connection from APM Webtop
    3. HTML5 client uses port 22443. I assume you mean the connection from APM to View Desktop. This should be documented by VMware.
    4. There is some mysterious problem on SSL layer.

    I wonder if (4) is caused by configuration on View Connection Server? I only have 5.2 environment and I can't recall any such certificate option in GUI except for SmartCard auth which APM does not support at the moment. I assume it's something else - but still worth checking. Also, there are a bunch of options that VCS does not expose to GUI - they are configured via "locked.properties" file somewhere under VCS installation folder. Maybe you have something there?

     

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Mar 03, 2014
    1. Agreed.
    2. Not timeouts. You can see the connections made. VMWare RESETS (tcp reset) the connections AFTER they're established.
    3. HTML5 works. No issues with that. Yes, over tcp/22443
    4. Well, there was an issue. I need to do some more investigation to find out WHAT was wrong with the server_ssl profile. Probably a setting in VMWare somewhere. But we haven't found out what yet...

    H

     

  • scott_messler_1's avatar
    scott_messler_1
    Icon for Nimbostratus rankNimbostratus
    Jul 14, 2015

    Hamish,

     

    It appears we are having a similar issue with the F5 timeout when connecting to a VMware View 5.3 connection server. The strange part is I can authenticate to APM and from the APM logs the connection was sent down the correct allowed branch but then I receive a connection with the server was terminated abnormally View error. Just curious if you ever found a solution.

     

    Thanks, Scott

     

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Jul 15, 2015

    Umm... yeah. There's a couple of other postings around here on what we had to do. I keep meaning to try & have words with the devs about making sure that the logs from APM mean something and provide meaningful info when you're trying to debug things. There's a few places where the logs are just a wee bit too subtle.

     

    The biggest things I found were

     

    1. Missing the server name being set in the PCOIP ssl profile used for connecting to the server
    2. Adding either an AVR or logging profile to the VS (Silent failures)

    2 is more likely... It just breaks. I added a custom iRule to log the info. I suspect that when the PCoIP stream is started the AVR/Log profile isn't disabled, and they abort the stream because they can't interpret the traffic (I still dislike that feature/bug).

     

    Hamish