Forum Discussion
TCP Profile with Verified Accept enabled and three-way TCP handshake
Hi,
I'm trying to understand exactly how the Standard virtual server processes connections using the full proxy architecture works when Verified Accept is enable on the TCP profile.
With Verified Accept disabled, the three-way TCP handshake occurs on the client side of the connection before the BIG-IP LTM system initiates the TCP handshake on the server side of the connection. Only when the client side TCP handshake is complete, LTM chooses a pool member and start the server side three-way TCP handshake.
When Verified Accept is enabled, "the system sends the server a SYN packet, and waits for the server to respond with a SYN-ACK, before responding to the client's SYN with a SYN-ACK" (K98387022: TCP Profile with Verified Accept enabled).
My question :
- when Verified Accept is enabled the server side TCP handshake is completed before or after the client side TCP handshake ?
I'm confusing because in the F5 documentation this behavior is not clearly described and because in the document K98387022 I read this example :
For example, given an HTTP virtual server, the order of events changes.
Verified Accept disabled: CLIENT_ACCEPTED -> HTTP_REQUEST -> LB_SELECTED -> SERVER_CONNECTED -> HTTP_REQUEST_SEND
Verified Accept enabled: CLIENT_ACCEPTED -> LB_SELECTED -> SERVER_CONNECTED -> HTTP_REQUEST -> HTTP_REQUEST_SEND
If I'm not mistaken, CLIENT_ACCEPTED means that the connection has been established and that the three-way handshake is complete. So, in this example the client side handshake is completed before the server side handshake in both cases ?
Thanks for your help
Diego
with verified accept: server side 3 way handshake completes before f5 replies SYN-ACK to client's SYN
4 Replies
Hiii Diego, how r u?
With Verified Accept enabled, the BIG-IP completes the server-side three-way handshake before completing the client-side handshake. The client does not receive a SYN-ACK until the selected pool member has successfully responded to the SYN. This guarantees that the connection is only accepted if a backend server is actually reachable
- diego2
Altostratus
Hi Jose, thank you for your reply.
The client does not receive a SYN-ACK until the selected pool member has successfully responded to the SYN, ok. But the ACK to the pool member that complete the three-way server-side handshake is sent before or after the SYN-ACK to the client ?
Is the SYN-ACK that the server sent to reply to the SYN of the Big IP the guarantee that the connection is accepted ?
If the server-side three-way handshake occurs before the client-side three-way handshake, what it means that :
Verified Accept enabled: CLIENT_ACCEPTED -> LB_SELECTED -> SERVER_CONNECTED -> HTTP_REQUEST -> HTTP_REQUEST_SEND
Thanks
with verified accept: server side 3 way handshake completes before f5 replies SYN-ACK to client's SYN
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com