For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Anesh's avatar
Anesh
Icon for Cirrostratus rankCirrostratus
May 08, 2014

TCP keep Alive Reset

I have a F5 LTM VIP with the below config

 

Vitrual test{ destination 6.6.6.6:9041 ip-protocol tcp persist { source_addr{ default yes} } pool test profiles{ test_9041{} } snat automap }

 

ltm profile tcp test_9041{ app-service noce defaults from tcp-lan-optimized keep-alive-interval 60 }

 

When i telnet to the above VIP, the connection is reset after 60 seconds, this started happening soon after i implemented the keep alive interval for 60 seconds

 

The Question is why is the connection reset after 60 seconds, even though the idle-time-out setting is default for 300 seconds So ideally the telnet connection should be reset only after 300 seconds, correct??

 

6 Replies

  • Correct, unless your server is resetting the connection. Can you do a packet capture on the server side and see if the server is sending the reset?

     

  • Anesh's avatar
    Anesh
    Icon for Cirrostratus rankCirrostratus

    I forgot to mention I am doing a telnet to a https port. Is it because the port expects a ssl handshake??

     

  • Correct. You are encountering the SSL handshake timeout. You can modify it however you see fit:

     

    http://support.f5.com/kb/en-us/solutions/public/13000/800/sol13834.html

     

  • Anesh's avatar
    Anesh
    Icon for Cirrostratus rankCirrostratus

    But this VIP is SSL passthrough and does not use any SSL profiles

     

  • I am not sure if you tried persistence profile or not, if not you may try looking into it.

     

  • Anesh's avatar
    Anesh
    Icon for Cirrostratus rankCirrostratus

    I am using source ip persistence, and i dont think it is a persistence issue, since i see the record in the persistence table even after the connection is removed from the connection table after 60 seconds.