Forum Discussion
SSL client to f5 and f5 to websever
Your config looks essentially correct, so the first thing I'd do is determine where it's failing.
tcpdump -lnni 0.0 host x.x.x.x
where x.x.x.x is the VIP's destination address. This will show the client side traffic. You could also specify the VLAN name for the -i (example: -i internal_vlan). The 0.0 name catches all traffic, so you need to be specific with the filter. You should definitely see this client side traffic. Now run the same command using the IP address of the web server as the filter.
tcpdump -lnni 0.0 host y.y.y.y
If you see any traffic from your client to the web server, then you can reasonably suspect that the issue lies on the server side of the proxy. The next step would be to fire up the SSLDUMP and see what may be going on inside the SSL handshake:
ssldump -k -i 0.0 -AdNn port 443 and host y.y.y.y
where:
-k = the physical path to the private key used by the web server. You may not have this private key on the BIG-IP, so you'll need to upload it somewhere.
-i 0.0 = all interfaces
-AdNn = a set of options that specify to decrypt the traffic if possible (and to simplify the output)
port 443 and host y.y.y.y = unlike TCPDUMP, the SSLDUMP must have a filter. Here we're specifying that we want to listen for port 443 traffic to/from the web server's IP address
You can certainly upload that SSLDUMP here for the group the analyze, but if the capture otherwise looks normal, then I'd next start working up the stack. I notice that you have an iRule applied and I vaguely remember a discussion form another post that refers to this, but
- Have you tested this VIP without the iRule?
- Have you tested this VIP with the iRule but without SSL?
-
Do you see any errors in the LTM log?
tail -f /var/log/ltm
In other words, given the error indication, a layer 7 problem can look just like a layer 6 or layer 4 problem. I'm always inclined to work from the bottom up, as more often than not the issues are network or SSL related, but you could certainly be experiencing an application layer problem.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com