Forum Discussion
harry_35316
Nimbostratus
NimbostratusDiff in pool and virtual server connections
Hi All, We have a virtual server configured as follows: When i check the virtual server current connections, it show 316. But for the pool connections the current connections as 0. Can any one hel...
hoolio
Cirrostratus
CirrostratusThere are a few options (in order by what I think your requirements are):
1. Standard TCP VIP without any client or server SSL using SSL session ID persistence. No HTTP inspection or modification possible.
2. Standard TCP VIP with a client and server SSL profile. This would add load to both LTM and the servers for decrypting and re-encrypting the SSL, but would allow you to inspect and modify the HTTP on LTM and keep all traffic on the wire encrypted.
3. Use a performance layer 4 VIP and no client or server SSL profiles. This is the fastest in terms of LTM processing, but also the most limited in terms of functionality. You cannot use client or server SSL, an HTTP profile for inspection or modification, cookie insert persistence, etc.
Aaron
- It's a bit hard on our end to diagnose what's going wrong with your setup. The "Connection timed out" error indicates one of a couple of things.
1. The URL to the iControl endpoint is not valid.
2. The URL to the iControl endpoint is not routable.
3. The java setup on your Linux box doesn't have all the SSL (jsse) code required for the SSL connection.
I'd start by printing out the full URL that you are connecting to (ie. https://x.x.x.x/iControl/iControlPortal.cgi). Then try to test connectivity from the new machine (with a browser, curl, wget, ...).
If you can connect to the endpoint with means outside of java, then odds are it's a jsse issue. I really don't think so as the connect timed out error almost always indicates an issue with the connection string or routing from the client to the BIG-IP.
-Joe - Smitha_111683Thanks Joe for the pointers. The issue has been resolved. It was a security feature that does not allow to connect to bigip address on the external vlan from a host on the internal vlan.
jimbob22_43693I'm running into what looks to be this same issue. Would it be possible to elaborate on what that security feature was? Is it something I change on the BigIP?
Thanks.
Danny Agapito (datasynapse)- hoolioHi Danny,
It's port lockdown. You can get more info on it in SOL7317 (Click here). iControl will make calls to the BIG-IP via port 443 so that's what you would want to check for.
Aaron
![\"F5](\"https://www.f5.com/content/dam/f5/f5-logo.svg\"){kind=logo}
