Forum Discussion

diego2's avatar
diego2
Icon for Altostratus rankAltostratus
Feb 10, 2026
Solved

TCP Profile with Verified Accept enabled and three-way TCP handshake

Hi,

I'm trying to understand exactly how the Standard virtual server processes connections using the full proxy architecture works when Verified Accept is enable on the TCP profile.

With Verified Accept disabled, the three-way TCP handshake occurs on the client side of the connection before the BIG-IP LTM system initiates the TCP handshake on the server side of the connection. Only when the client side TCP handshake is complete, LTM chooses a pool member and start the server side three-way TCP handshake.

When Verified Accept is enabled, "the system sends the server a SYN packet, and waits for the server to respond with a SYN-ACK, before responding to the client's SYN with a SYN-ACK" (K98387022: TCP Profile with Verified Accept enabled).

My question :

  • when Verified Accept is enabled the server side TCP handshake is completed before or after the client side TCP handshake ? 

I'm confusing because in the F5 documentation this behavior is not clearly described and because in the document K98387022 I read this example :

 

For example, given an HTTP virtual server, the order of events changes.

Verified Accept disabled: CLIENT_ACCEPTED -> HTTP_REQUEST -> LB_SELECTED -> SERVER_CONNECTED -> HTTP_REQUEST_SEND

Verified Accept enabled: CLIENT_ACCEPTED -> LB_SELECTED -> SERVER_CONNECTED -> HTTP_REQUEST -> HTTP_REQUEST_SEND

 

If I'm not mistaken, CLIENT_ACCEPTED means that the connection has been established and that the three-way handshake is complete. So, in this example the client side handshake is completed before the server side handshake in both cases ?

 

Thanks for your help

Diego

  • with verified accept: server side 3 way handshake completes before f5 replies SYN-ACK to client's SYN

4 Replies

  • Hiii Diego, how r u?

    With Verified Accept enabled, the BIG-IP completes the server-side three-way handshake before completing the client-side handshake. The client does not receive a SYN-ACK until the selected pool member has successfully responded to the SYN. This guarantees that the connection is only accepted if a backend server is actually reachable

     

    • diego2's avatar
      diego2
      Icon for Altostratus rankAltostratus

      Hi Jose, thank you for your reply.

      The client does not receive a SYN-ACK until the selected pool member has successfully responded to the SYN, ok. But the ACK to the pool member that complete the three-way server-side handshake is sent before or after the SYN-ACK to the client ? 

      Is the SYN-ACK that the server sent to reply to the SYN of the Big IP the guarantee that the connection is accepted ? 

      If the server-side three-way handshake occurs before the client-side three-way handshake, what it means that :

      Verified Accept enabled: CLIENT_ACCEPTED -> LB_SELECTED -> SERVER_CONNECTED -> HTTP_REQUEST -> HTTP_REQUEST_SEND

       

      Thanks

       

      • with verified accept: server side 3 way handshake completes before f5 replies SYN-ACK to client's SYN