Forum Discussion

Jerry_Bruce's avatar
Jerry_Bruce
Icon for Nimbostratus rankNimbostratus
Sep 24, 2019

Pulse Secure - ESP switching to SSL after timeout

Does anyone have experience with setting up an Active/Active pair of Pulse Secure PSAs behind the F5 using LTM? We have a VS set-up with access to the backend appliances. The Pulse client connects successfully using SSL initially, switches to ESP, then falls back to SSL after reaching the timeout of 15 seconds which is the default on the PSA. We have a persistent profile configured for the VS that is configured for UDP:4500. There is no firewall that is blocking UDP:4500.

 

Any suggestions?

application delivery
BIG-IP
LTM
Pulse Secure
  • Jerry_Bruce's avatar
    Jerry_Bruce
    Icon for Nimbostratus rankNimbostratus
    Oct 08, 2019

    We were able to solve this. We determined that UDP:4500 was being blocked from the F5 to the external interfaces on the cluster. Once the traffic was being allowed the sessions would still not maintain an ESP connection until we disabled the SPI lookup

     

    modify sys db ipsec.lookupspi value disable

    (K14169).