Forum Discussion

draco's avatar
draco
Icon for Nimbostratus rankNimbostratus
Aug 14, 2015

RST,ACK sent from server to VIP .

Setup on F5

 

standard Virtual server with service port 80 with 4 pool members.When access via the VIP , the external user is trying to browse NATted IP which is natted to the VIP , the user is not able to access.

 

But when tried accessing directly to one of the pool members,they are able to browse.

 

When i did packet capture

 

tcpdump -ni 0.0:nnn -s0 -w /var/TEST.pcap host

 

I can see a tcp-[rst,ACK] from the source-IP to VIP .

 

Does this mean there is RSt sent from the VIP ? but i am not seeing any RSt from the f5 interface internal IP as i did packet capture to pool members.

 

I dont see a Reset packet sent , should i run a tcp/reset debug on f5 next time to proceed further ?

 

Also, we are doing an http monitor and its with authentication too.

 

Could you let me know how does that monitor work ? F5 gives those credentials while monitoring?

 

The RESET,ACK is seen always after a http/1.1 401 unauthorised.

 

The source user isnt getting any page to put in his credentials either. ITs just page cannot be displayed.So how is that unauthorized response being sent ?

 

Do look into this and help me out.

 

application delivery
LTM
monitor
TMOS
TMSH

3 Replies

Sort By
  • draco's avatar
    draco
    Icon for Nimbostratus rankNimbostratus
    Aug 15, 2015

    Please do reply...am pretty stuck as to what is happening as am new to f5 .

     

  • Greg_Robinson_1's avatar
    Greg_Robinson_1
    Icon for Cirrus rankCirrus
    Aug 17, 2015

    There are some questions I have first.

     

    You say they're trying to browse to a VIP that is NAT'd. Does the NAT occur on or before the F5? It sounds like this:

     

    Host --- (NATing device) --- F5 VIP --- pool member

     

    Is this correct?

     

    The F5 will authenticate into HTTP using the credentials assigned for monitoring. Is that monitor successful?

     

    Last, where is the TCP RST shown, on the server side of the F5 or the client side?

     

    Thanks

     

  • Daren_Matthews's avatar
    Daren_Matthews
    Icon for Nimbostratus rankNimbostratus
    Aug 20, 2015

    The tcpdump might not have captured all of the packets due to the host filter. https://support.f5.com/kb/en-us/solutions/public/14000/300/sol14335

     

    If you do capture the HTTP traffic, the HTTP 401 should also contain a "WWW-Authenticate header" that shows how to authenticate. If it doesn't contain that header that is the next thing to investigate. Also if it does contain that header and the method is "negotiate" it could be due to: https://support.f5.com/kb/en-us/solutions/public/11000/100/sol11110.html

     

    • Daren