For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Fabrizio_Chiava's avatar
Fabrizio_Chiava
Icon for Nimbostratus rankNimbostratus
Sep 21, 2012

PDF corruption - iRule Selective SNAT

Hello,

I'm a problem to the customer with an iRule. He implemented on his VS (LTM v10.2.x) this iRule "Selective SNAT" on below:

when
LB_SELECTED
{

if {[IP::addr "[IP::client_addr]/24" equals "[LB::server addr]/24"]} {

snat automap

}

}

He has problem when download a PDF file from pool member because he download a corrupted file. 5 mounth ago I disabled the default "http" profile, but now I need this profile for iRule application on Virtual Server.

So, I believe that there is a good way to solve this issue, and then what could be the http profile parameter to solve this issue? Could it be possible to manage the compression section? http profile has default configuration.

Thanks in advance

Best Regards

Fabrizio.

application delivery
dev
devops
iRules

10 Replies

  • Mohamed_Lrhazi's avatar
    Mohamed_Lrhazi
    Icon for Altocumulus rankAltocumulus
    Sep 21, 2012
    Create a new virtual server, for testing. Configure it the same way as the current one. then test it.

     

     

    Don't use default http profile, make your own, based on the default.

     

     

    Apply new profile to test virtual server. debug the problem there untill solved, then apply the correct changes to your real virtual server.

     

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Sep 21, 2012
    Compression is the first thing that came to my mind. I'd try enabling Response Chunking and setting it to Rechunk first. If that still doesn't solve the issue I'd suggest adding application/pdf to the compression content list exclude list. If that doesn't work, capture the traffic and find out what MIME/content type is being used and exclude that, or of course, just turn off compression.
  • Fabrizio_Chiava's avatar
    Fabrizio_Chiava
    Icon for Nimbostratus rankNimbostratus
    Sep 21, 2012
    Hi Mohamed,

     

    thank you for your reply, I need to do that, but unfortunately I need to manipulate the http value from http profile.

     

     

    I thinking about the caching and compression.

     

     

    Thanks

     

    Regards

     

    Fabrizio.
  • Fabrizio_Chiava's avatar
    Fabrizio_Chiava
    Icon for Nimbostratus rankNimbostratus
    Sep 28, 2012
    Hi,

     

    the customer has a default http profile (based on parent) that it used only for iRule application on Virtual Server, so it keep default configuration and I noticed that compression is disabled.

     

     

    I could disable compression from content list exclude list as you indicated and performing test.

     

     

    Thanks in advance

     

    Regards

     

    Fabrizio

     

  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Sep 28, 2012
    You're right, compression is disabled by default. In that case there's no need to modify the HTTP Profile. Can you remove the iRule from the Virtual Server and test and see if that makes a difference, just so we can rule that out.
  • Fabrizio_Chiava's avatar
    Fabrizio_Chiava
    Icon for Nimbostratus rankNimbostratus
    Oct 03, 2012

    I just did this test, in fact if I removed the http profile from Virtual Server, now clients can download the file correcly from server.

     

    So, I think this problem could be a single value of http profile, I don't know which one.

     

     

    F.

     

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Oct 03, 2012
    have you seen this one? can you try the irule in Perry's reply?

     

     

    Problems downloading files with CACHE-CONTROL header

     

    https://devcentral.f5.com/Community/GroupDetails/tabid/1082223/asg/50/aft/12011/showtab/groupforums/Default.aspx
  • Fabrizio_Chiava's avatar
    Fabrizio_Chiava
    Icon for Nimbostratus rankNimbostratus
    Oct 03, 2012
    Yes, but I applied the iRule on below:

     

     

    when HTTP_RESPONSE {

     

    if { [HTTP::header "Content-Type"] contains "application" } {

     

    HTTP::version "1.0"

     

    }

     

    }

     

     

    I have to test iRule that Perry has indicated.
  • Fabrizio_Chiava's avatar
    Fabrizio_Chiava
    Icon for Nimbostratus rankNimbostratus
    Oct 12, 2012
    Hi,

     

    for your information I solved the issue configuring Virtual Server without http profile, because there is no need to inspect http packets until Layer 7.

     

     

    So, thanks to all for your support.

     

    Fabrizio