Forum Discussion
TCP connection resets on LTM
virtual citrixappsremote{
snat automap
pool pool_citrixappsremote
destination 192.168.16.68:https
ip protocol tcp
profiles {
citrixapsremote {
clientside
}
http {}
tcp {}
}
}
pool pool_citrixappsremote {
lb method member least conn
monitor all http
members {
192.168.16.25:http {}
192.168.16.100:http {}
}
}
Executing ''curl" is successful and i can see complete SSL handshake taking place on the device. But the external user is not able to access the site.
Here is the output from TCP dump
06:07:45.514632 IP plkfintjmp01v.corporate. .53553 > citrixappsremote. .http: S 3182411697:3182411697(0) win 64512
06:07:45.514644 IP citrixappsremote. .http > plkfintjmp01v.corporate. .53553: R 0:0(0) ack 3182411698 win 0
06:07:46.012328 IP plkfintjmp01v.corporate. .53553 > citrixappsremote. .http: S 3046774539:3046774539(0) win 64512
06:07:46.012339 IP citrixappsremote. .http > plkfintjmp01v.corporate. .53553: R 0:0(0) ack 4159330139 win 0
06:07:46.414747 IP plkfintjmp01v.corporate. .53553 > citrixappsremote. .http: S 191358774:191358774(0) win 64512
06:07:46.414758 IP citrixappsremote. .http > plkfintjmp01v.corporate. .53553: R 0:0(0) ack 1303914374 win 0
06:07:50.809118 IP plkfintjmp01v.corporate. .53567 > citrixappsremote. .http: S 2623997703:2623997703(0) win 64512
06:07:50.809130 IP citrixappsremote. .http > plkfintjmp01v.corporate. .53567: R 0:0(0) ack 2623997704 win 0
06:07:51.242950 IP plkfintjmp01v.corporate. .53567 > citrixappsremote. .http: S 3133539186:3133539186(0) win 64512
06:07:51.242975 IP citrixappsremote. .http > plkfintjmp01v.corporate. .53567: R 0:0(0) ack 509541484 win 0
- hooleylistCirrostratusHi,
- smp_86112Cirrostratushoolio asks good, valid questions. If it were me, I would also try and telnet from the LTM to the pool members on port 80, to make sure they are indeed accepting connections, and that there's not something like a firewall blocking the connection. If you can't make a connection from the LTM to the pool member, then obviously the client connection will fail.
- er_sandy_27437NimbostratusHello Hoolio,
- smp_86112CirrostratusI am a bit confused by the evidence you are providing. One one hand, you claim you are using curl to connect to an HTTPS VIP. On the other hand, the trace you provided shows a connection to port 80 - not port 443. That's why hoolio asked which side of the ltm was the trace you provided taken on - the external (i.e. client) side, or the internal (i.e. server) side? If the trace was taken on the client side, then of course the LTM sent a RST because the connection from the client was HTTP (port 80), not HTTPS (port 443), and you probably don't have an HTTP (port 80) VIP. But if the trace was taken on the server side, then it was the Pool Member who is sending a TCP RST - not the LTM. That was why I advised you to attempt to telnet to the pool member on port 80 from the LTM - it will validate whether or not a TCP connection with the Pool Member is being acknowledged.
- er_sandy_27437NimbostratusIT was taken from the client side. I am uploading another set of capture taken for the https, still the issue was the same.
- smp_86112Cirrostratus
OK, now that makes sense. So the LTM is sending a RST to the client because the Pool Member is sending a RST to the LTM. Think of what happens on both sides of the LTM.
1) Client initiates a TCP connection with the LTM on port 443 on the external side.
2) LTM makes a TCP connection with the Pool Member on port 80 on the internal side.
3) Pool Member sends a TCP RST to the LTM on the internal side.
4) LTM sends a TCP RST to the client on the external side, because the Pool Member refused a connection.
Again, I advise you to try and make a TCP connection with your Pool Member from the LTM with telnet (telnet 80). I bet you get a TCP RST.
- er_sandy_27437NimbostratusStrangely this problem resolved by changing the IP of the VIP. While they were in same subnett it was not working but putting them in seperate routed subnet solved the issue. Can somebody have an explaination to that?
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com