For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ccraddock's avatar
ccraddock
Icon for Cirrus rankCirrus
Jul 26, 2019

TCP states of Virtual Servers

Community, Is there any way to see the actual TCP states of a Virtual server both between the client and VS as well as the VS and the pool member? I can run a show /sys connection and see the IP's a...
application delivery
BIG-IP
LTM
Hamish's avatar
Hamish
Icon for Cirrocumulus rankCirrocumulus
Jul 27, 2019

I can't help but think that this is somehow a connectivity issue between the BigIP and the Jira server. Because as you state there FIN/ACK is never sent by Jira, even though the FIN is (presumably) seen arriving at the Jira

 

  • Is the BigIP to Jira connection passing through a firewall?
  • If you tcpdump a connection between the BigIP and the Jira server at BOTH the BigIP and the Jira server, then what do you see at the end of the connection at each end? Is it possible that one of the FIN's is being lost somewhere in the network?
ccraddock's avatar
ccraddock
Icon for Cirrus rankCirrus
Jul 29, 2019

Hamish,

 

Thanks for the response. The next step is definitely to do a TCP dump at the F5. The inbound traffic to Jira coming from the F5 is not going through a FW as the F5 has a direct layer 2 connection (VLAN) into the subnet. However, the Jira server's response has to pass through a firewall in order to return to the F5. What I find interesting is the following:

 

The VS is on the 10.110.8.x subnet and Jira is on the 10.110.90.x subnet. When we do a TCP dump on Jira, Jira sees the traffic coming from 10.110.8.92 (the VS) and not the floating IP for the Jira subnet on the F5 (10.110.90.7). In this instance Jira has to route its return traffic back thru our Firewall, because the firewall is its default gateway. I am considering SNAT'ing the traffic so that inbound traffic appears to be coming from the floating IP 10.110.90.7 and thus Jira should not have to route its return traffic thru our FW.

 

UPDATE: This issue is completely unrealted to the F5 and has to do with Jira application not closing out its own TCP:443 connections. We confirmed that all browser based connections either directly or through the F5 are closing without issue. The only sessions that arent closing are the ones being sourced by the Jira server itself. Thanks for your help!