unable to telnet to the VIP but ping work

Question

Hi,&nbsp;
I have an issue where we a VIP configured to listen on port 443.
VIP status is up. We are able to ping the VIP but telnet to port 443 isnt working.
Did a packet capture and found syn packet flowing into the LTM but see no syn-ack response going out.
Port-lockdown has been set to allow all and its a standard VIP.&nbsp;
ltm virtual /Common/cloudv1.test_443 {
    destination /Common/10.10.10.5%1:443
    ip-protocol tcp
    mask 255.255.255.255
    pool /Common/test_pool
    profiles {
        /Common/uat_ssl {
            context clientside
        }
        /Common/tcp { }
    }
    source 0.0.0.0%1/0
    source-address-translation {
        type automap
    }
    translate-address enabled
    translate-port enabled
}&nbsp;
Also I tried telnet the self ip on the LTM for port 443 but it isnt responding either.&nbsp;
[root@LTMnew:Active:Standalone] config  rdexec 1 telnet 10.10.10.5 443
Trying 10.10.10.5...
^C
[root@LTMnew:Active:Standalone] config  rdexec 1 telnet 10.10.10.2 443
Trying 10.10.10.5...
telnet: connect to address 10.10.10.5: Connection refused
[root@LTMnew:Active:Standalone] config &nbsp;
Product: BIG-IP
Version: 11.5.1
Build: 5.0.147
Sequence: 11.5.1.5.0.147.0
BaseBuild: 0.0.110
Edition: Hotfix HF5
Date: Wed Oct  1 12:10:21 PDT 2014
Built: 141001121021&nbsp;
Do you think I missed some setting on the LTM?&nbsp;

what_lies_bene1 · Answer

Any packet filters in play? AFM installed? Auto Last Hope disabled?

parvez_70211 · Answer

packet filter disabled.
AFM not installed
Auto Last hop enabled globally and default setting at the VIP level.&nbsp;

parvez_70211 · Answer

We have ASM installed but the license has been expired. Could this be an issue?&nbsp;

what_lies_bene1 · Answer

Thanks. The VS isn't associated with ASM in any way based on the config output you posted so I doubt it but worth double-checking.&nbsp;
No http profile assigned I see, is that by design?&nbsp;
I assume routing is configured such that the F5 routes back to wherever your testing from, via the same interface?&nbsp;
FYI, the Port Lockdown setting has no bearing where Virtual Servers are concerned.&nbsp;

nathe · Answer

Are you able to run tcpdump and see where this syn-ack might be? I also agree with WLB - you might want to double the routing side of things too

Forum Discussion

unable to telnet to the VIP but ping work

Recent Discussions

Network failover - peer-offline

APM CPU allocation

SNMP Health Monitors

vscode ucs save edits

APM : is VMware Workspace One supported as an Endpoint Management System?

Related Content

Enable telnet on SSH

unable to ping VIP from server with the F5 as the DGW

Unable to access GUI

F5-OS Rseries. Asking about Ping command

Unable to update device cert