Troubeshooting website connection

Question

We are using BIG-IP with LTM and SSLO to inspect web application traffic. What are good troubleshooting techniques to go through the device when a website doesn't establish connection? We would want to eliminate the F5 from being the cause and attempt to narrow down where the traffic is getting broken if possible.&nbsp;

lucas_thompson · Accepted Answer

By "these modules", I'm assuming you mean "the SSL Orchestrator module". We do have a deployment guide over here that is very comprehensive:
https://clouddocs.f5.com/sslo-deployment-guide/sslo-11/
Reading the deployment guide will give you a good understanding of how the SSL Orchestrator module works and how to set it up.
SWG and SSLO essentially use the same architecture but the setup is somewhat different, as you've no doubt found. We generally recommend using SSLO to perform the setup, then using "SWG as a Service" to perform custom authentication, auditing, or authorization logic as needed. That is covered here:
https://clouddocs.f5.com/sslo-deployment-guide/sslo-11/chapter3/page3.06.html
&nbsp;

zamroni777 · Answer

usually i use tcpdump to analysze the ssl and http layer.for encrypted traffic, add --f5 ssl option:https://my.f5.com/manage/s/article/K31793632

lucas_thompson · Answer

Network troubleshooting is usually easiest when you break down the problem into layers. We do have a troubleshooting guide for SSL Orchestrator over here:
https://clouddocs.f5.com/sslo-troubleshooting-guide/troubleshooting.html#data-plane
That link has a flowchart. Each item on the flowchart has information about how it works and what evidence to get to prove that it's working. You should probably start reading in that area to get an understanding of what approaches might be best for your environment.

tstott707 · Answer

Thank you for the attachment and explanation. We deployed the SSLO and rarely have to make the changes with that module when websites have issues. We do run LTM using iRules and Data Group along with SWG and website bypassing when needed. Is there another article that walks through a checklist when you are implementing these modules in the environment.&nbsp;

tstott707 · Answer

Thanks Lucas. I will read these and then post another topic if I have something else

tstott707 · Answer

Thanks Zamroni777. Will add this to the troubleshooting steps as well

Forum Discussion

Troubeshooting website connection

6 Replies

Recent Discussions

ASM instance creation

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Open Redirection Mitigation

F5Access | MacOS Sonoma

enable tls1.2 on management interface on F5 ltm running version 10.x

Related Content

Fake website, Gmail guideline, GPS spoofing, OWASP LLM, Jan 1st–5th F5SIRT This Week in Security

F5 Websites Accessibility Survey

Securely connecting Kubernetes Microservices with F5 Distributed Cloud

Release Notes: DevCentral Website

F5 Connection Mirroring question