For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Edu_50128's avatar
Edu_50128
Icon for Nimbostratus rankNimbostratus
Sep 03, 2013

Thanks all

 

I have configured the wilcard server as you told me, and now the capture I made says it:

 

[admin@ITX196009BDMZ:Active] ~ tcpdump -i 0.0 -nn src host 192.168.159.65 and dst host 194.140.77.184 or src host 194.140.77.184 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 0.0, link-type EN10MB (Ethernet), capture size 96 bytes 08:56:30.622616 IP 192.168.159.65.4366 > 194.140.77.184.80: S 1441212874:1441212874(0) win 65535 08:56:30.622629 IP 194.140.77.184.80 > 192.168.159.65.4366: S 1590552708:1590552708(0) ack 1441212875 win 4380 08:56:30.623063 IP 192.168.159.65.4366 > 194.140.77.184.80: . ack 1 win 65535 08:56:30.623493 IP 192.168.159.65.4366 > 194.140.77.184.80: S 3025978864:3025978864(0) win 4380 08:56:30.623878 IP 192.168.159.65.4366 > 194.140.77.184.80: P 1:302(301) ack 1 win 65535 08:56:30.623884 IP 194.140.77.184.80 > 192.168.159.65.4366: . ack 302 win 4681 08:56:33.623154 IP 192.168.159.65.4366 > 194.140.77.184.80: S 3025978864:3025978864(0) win 4380 08:56:36.823366 IP 192.168.159.65.4366 > 194.140.77.184.80: S 3025978864:3025978864(0) win 4380 08:56:40.022999 IP 192.168.159.65.4366 > 194.140.77.184.80: S 3025978864:3025978864(0) win 4380 08:56:43.223354 IP 194.140.77.184.80 > 192.168.159.65.4366: R 1:1(0) ack 302 win 4681

 

It seems the traffic go away from the BIG-IP, but the page is not loaded. In the FW has open the traffic for IP 192.168.159.65 on http service.

 

The wilcard vs configurar is with the standard option, no translation address and with a pool define with this server (192.168.159.65).

 

What could be happening? Does the FW be configured with the IP of the BIG-IP also to permit this traffic? any other problem in the the BIG-IP?

 

Thanks

 

boneyard's avatar
boneyard
Icon for MVP rankMVP
Sep 03, 2013
192.168.159.65 is the system which should be able to access the internet right? then it should not be the pool for the wildcard virtual server, if you want to use a pool for the wildcard virtual server (you dont have to then it just uses the default route from the big-ip) you can use an interface on the firewall or router towards the internet.