Forum Discussion

Chris_Richards_'s avatar
Chris_Richards_
Icon for Nimbostratus rankNimbostratus
Aug 03, 2018

Virtual Server not forwarding to Website

I'm trying to setup the F5 to takeover our reverse proxy functionality for websites. But when I've tested the site externally it does not display. I can see it hitting the Virtual server but is not using the traffic policy to forward to the correct server.

 

The F5 sits behind our firewall and we NAT our external IP address to the F5 Virtual Server Address on it's external interface. From their I've created a traffic policy to forward the request to the node hosting the website. The web server is on the same subnet as the internal IP of the F5.

 

I did initially create a VS with an internal IP address to test the connection with the traffic policy and that worked.

 

I suspect I've missed something obvious. Does anyone have any suggestions?

 

application delivery
BIG-IP Access Policy Manager (APM)
LTM
  • MvdG's avatar
    MvdG
    Icon for Cirrus rankCirrus
    Aug 03, 2018

    Hi,

     

    Several things you can check.

     

    Is the internal IP-address of the F5 configured as default gateway on the webservers? If not, yu should configure AutoMap or SNAT. (If you have a F5 cluster, the default gateway should be the Float IP-addres).

     

    Have you checked traffic on the internal and external interface of the F5 with tcpdump? Do you see traffic leaving the internal interface to the webservers?

     

    Is all OK within the Network Map?

     

    Create a simple setup without traffic policy. Just VIP -> Pool -> Node. Use a simple built-in Monitor and if SSL is needed, use the built-in SSL profiles. If this is working, add custom SSL profiles, Monitors and traffic policies to your configuration. But do it step by step so you can find out which part is causing the problem.

     

    Regards, Martijn

     

    • Chris_Richards_'s avatar
      Chris_Richards_
      Icon for Nimbostratus rankNimbostratus
      Aug 03, 2018

      Hi Martijn

       

      Thanks for the advice. Started again and I've got it working. I had an SSL client profile which was causing me the problem. Will take a look at SSL profilelater.

       

      I said it would be an obvious in the end.

       

      Regards

       

      Chris

       

  • Martijn_144688's avatar
    Martijn_144688
    Icon for Cirrostratus rankCirrostratus
    Aug 03, 2018

    Hi,

     

    Several things you can check.

     

    Is the internal IP-address of the F5 configured as default gateway on the webservers? If not, yu should configure AutoMap or SNAT. (If you have a F5 cluster, the default gateway should be the Float IP-addres).

     

    Have you checked traffic on the internal and external interface of the F5 with tcpdump? Do you see traffic leaving the internal interface to the webservers?

     

    Is all OK within the Network Map?

     

    Create a simple setup without traffic policy. Just VIP -> Pool -> Node. Use a simple built-in Monitor and if SSL is needed, use the built-in SSL profiles. If this is working, add custom SSL profiles, Monitors and traffic policies to your configuration. But do it step by step so you can find out which part is causing the problem.

     

    Regards, Martijn

     

    • Chris_Richards_'s avatar
      Chris_Richards_
      Icon for Nimbostratus rankNimbostratus
      Aug 03, 2018

      Hi Martijn

       

      Thanks for the advice. Started again and I've got it working. I had an SSL client profile which was causing me the problem. Will take a look at SSL profilelater.

       

      I said it would be an obvious in the end.

       

      Regards

       

      Chris