For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ciscoarc's avatar
ciscoarc
Icon for Nimbostratus rankNimbostratus
May 19, 2014

[Where/How] to use OneConnect for permanent connection?

Guys, I've been trying to get F5 to setup a permanent connection using OneConnect to a real server but couldn't make it work. So, here's what I have in my setup (all in Lab): Virtual Server: 11...
nitass's avatar
nitass
Icon for Employee rankEmployee
May 19, 2014

is the reset initiated by bigip indeed? can you check why bigip sends reset?

sol13223: Configuring the BIG-IP system to log TCP RST packets

http://support.f5.com/kb/en-us/solutions/public/13000/200/sol13223.html

i did a bit test and it seems okay here.

 config

root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm virtual bar
ltm virtual bar {
    destination 172.28.24.10:443
    ip-protocol tcp
    mask 255.255.255.255
    pool foo
    profiles {
        clientssl {
            context clientside
        }
        http { }
        oneconnect { }
        serverssl {
            context serverside
        }
        tcp { }
    }
    rules {
        qux
    }
    source 0.0.0.0/0
    source-address-translation {
        type automap
    }
    vs-index 26
}
root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm pool foo
ltm pool foo {
    members {
        200.200.200.101:443 {
            address 200.200.200.101
        }
    }
}
root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm rule qux
ltm rule qux {
    when CLIENT_ACCEPTED {
  log local0. "[IP::client_addr]:[TCP::client_port]"
}
when HTTP_REQUEST {
  log local0. "[IP::client_addr]:[TCP::client_port]"
}
when HTTP_RESPONSE {
  log local0. "[IP::local_addr]:[TCP::local_port]"
}
when CLIENT_CLOSED {
  log local0. "[IP::client_addr]:[TCP::client_port]"
}
when SERVER_CONNECTED {
  log local0. "[IP::local_addr]:[TCP::local_port]"
}
when SERVER_CLOSED {
  log local0. "[IP::local_addr]:[TCP::local_port]"
}
}

 test by sending 10 requests (1 request per connection)

[root@ve11a:Active:In Sync] config  tail -f /var/log/ltm
May 18 22:02:33 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37085
May 18 22:02:33 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37085
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 200.200.200.14:37085
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 200.200.200.14:37085
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37085
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37086
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37086
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 200.200.200.14:37086
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 200.200.200.14:37086
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37086
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37087
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37087
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 200.200.200.14:37085
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37087
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37088
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37088
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 200.200.200.14:37086
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37088
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37089
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37089
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 200.200.200.14:37085
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37089
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37090
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37090
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 200.200.200.14:37086
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37090
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37091
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37091
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 200.200.200.14:37085
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37091
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37092
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37092
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 200.200.200.14:37086
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37092
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37093
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37093
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 200.200.200.14:37085
May 18 22:02:34 ve11a info tmm[14715]: Rule /Common/qux : 172.28.24.1:37093
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37094
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37094
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 200.200.200.14:37086
May 18 22:02:34 ve11a info tmm1[14715]: Rule /Common/qux : 172.28.24.1:37094

[root@ve11a:Active:In Sync] config  grep CLIENT_ACCEPTED /var/log/ltm | wc -l
10
[root@ve11a:Active:In Sync] config  grep HTTP_REQUEST /var/log/ltm | wc -l
10
[root@ve11a:Active:In Sync] config  grep SERVER_CONNECTED /var/log/ltm | wc -l
2

[root@ve11a:Active:In Sync] config  tmsh show ltm profile one-connect

-----------------------------------
Ltm::OneConnect Profile: oneconnect
-----------------------------------
Virtual Server Name  N/A

Connections
  Current Idle         0
  Maximum              2
  Total Reuses         8
  New                  2