Forum Discussion

JoshBecigneul's avatar
JoshBecigneul
Icon for MVP rankMVP
Mar 26, 2024

Portal Access to HTTPS resources slow

Hey all,

Wanted to reach out to see if anyone has dealt with Portal Access and performance issues for resources in the backend that use HTTPS. I'm on version 15.x, recently upgraded to v15.1.10.3, and the issue persists. I also have the iRule to patch issues with Chrome 122+.

On the client-side, only HTTPS is permitted. If the backend app is allowed to use HTTP then it works well. But having backend traffic use HTTPS in some instances makes the app nearly unusable. And in the cases where the backend tries to enforce a http-to-https redirect effectively "blocks" the access.

Trying to change a number of options has yielded little results. I do have a case open with F5 and captures provided.

Thanks in advance...

Josh Becigneul

application delivery
  • spalande's avatar
    spalande
    Icon for Nacreous rankNacreous
    May 02, 2024

    Hi, Did you figure it out for this issue? Was it related to full patching settings vs minimal patching or something else? Alternatively, if applications are web based, then can be configured as application tunnel with Chrome or any other browser. 

  • zamroni777's avatar
    zamroni777
    Icon for Nacreous rankNacreous
    May 03, 2024

    please ensure that oneconnect profile is enabled on the http profile assigned to the vs, so that bigip can use 1 server side tcp connection for multiple client sessions.
    as 1 tcp session equals to 1 tls/ssl session, hence reducing number of server side tcp session will also reduce the number of server side tls session.

    you might also need to reduce tls cipher set strength of the server "side" ssl profile to reduce server processing load, e.g:

    • only use aes 128 bit and disable aes aes 256 or higher
    • disable ecdhe / dhe , hence it will only use rsa/dsa

     

    additionally, ensure that server uses hardware accelerated aes (intel/amd aes-ni).

     

  • Lucas_Thompson's avatar
    Lucas_Thompson
    Icon for Employee rankEmployee
    May 07, 2024

    You might want to try bypassing the clientside of the BIG-IP --> Portal Resource HTTPS connection's certificate verification by setting the serverssl profile to "ignore" the server's certificate, here:

     

     

  • Ben_Novak's avatar
    Ben_Novak
    Icon for Employee rankEmployee
    May 08, 2024

    Aside from the other great suggestions, I recommend planning a major code upgrade.  Minimum 16.1.x if you can't get to v17.1.x.  v15.1 code train goes End of Software Development at the end of 2024.

    K5903: BIG-IP software support policy

    https://my.f5.com/manage/s/article/K5903