For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

draco's avatar
draco
Icon for Nimbostratus rankNimbostratus
Aug 14, 2015

RST,ACK sent from server to VIP .

Setup on F5   standard Virtual server with service port 80 with 4 pool members.When access via the VIP , the external user is trying to browse NATted IP which is natted to the VIP , the user is no...
application delivery
LTM
monitor
TMOS
TMSH
Daren_Matthews's avatar
Daren_Matthews
Icon for Nimbostratus rankNimbostratus
Aug 20, 2015

The tcpdump might not have captured all of the packets due to the host filter. https://support.f5.com/kb/en-us/solutions/public/14000/300/sol14335

 

If you do capture the HTTP traffic, the HTTP 401 should also contain a "WWW-Authenticate header" that shows how to authenticate. If it doesn't contain that header that is the next thing to investigate. Also if it does contain that header and the method is "negotiate" it could be due to: https://support.f5.com/kb/en-us/solutions/public/11000/100/sol11110.html

 

  • Daren