why http 503 is returned to the client

There are number of things that you can do. Start by running tcpdump on the f5 internal and external interfaces to see properly what is going on. tcpdump -i -s0 -w /var/tmp/_1.cap host and port

in a different window, run tcpdump -i -s0 -w /var/tmp/_1.cap host or etc

This should capture the traffic. If it is SSL then use ssldump to decrypt it - ssldump -Aer -k -r _1.cap>>/var/tmp/ssldump_1.txt

Copy the files off with SCP, open them in Wireshark and look at both sides of the connection.