Forum Discussion
smp_86112
Apr 09, 2012Cirrostratus
Whoa, this is very wierd. I was just posting a message about this exact same problem. I found that disabling the SSL cache in the Client SSL Profile fixes it, but my DevCentral post was going to ask the question why?
In my case, I took a network trace and found the client initiates two TCP connections sequentially. In the first connection, the LTM sends a Server Hello response with a Session ID, the handshake goes on to successful completion, and the client submits a bunch of (wierd) HTTP requests. At some point, the Subversion server responded with a HTTP 409 Conflict which initiates a teardown of the TCP session. The client turns around and tries to open a new TCP session, and sends exactly the same Session ID that was sent by the LTM in the first TCP connection. And that packet is ACKed by the LTM, but then the connection sits idle until the TCP connection times out. Disabling the SSL cache in the Client SSL Profile seems to force the LTM to send the certificates on each new TCP connection. The question is why won't the LTM allow the client to open a new TCP connection using a cached session?
I have no idea how to troubleshoot this. Does anyone else?
Also, the iRules forum doesn't seem like the right place for this thread - can the moderators move it to somewhere appropriate?