For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

m1978_295079's avatar
m1978_295079
Icon for Nimbostratus rankNimbostratus
Jun 13, 2017

Why I am able to Telnet to VIP when pool members are down ??

Why I am able to telnet to a VIP (port 443) when all pool members actually down, VS showing down as well. Could someone please explain in brief.  
BIG-IP
devops
Samir_Jha_52506's avatar
Samir_Jha_52506
Icon for Noctilucent rankNoctilucent
Jun 13, 2017

Its default behavior of Standard virtual server, A Standard virtual server processes connections using the full proxy architecture. The three-way TCP 3-way- handshake occurs on the client side of the connection before the F5 LTM system initiates the TCP 3-way-handshake on the server side of the connection. Please go through link.

 

https://support.f5.com/csp/article/K8082

 

  • tatmotiv's avatar
    tatmotiv
    Icon for Cirrostratus rankCirrostratus
    Jun 13, 2017

    That's indeed right for standard virtuals with a TCP profile attached to it, but the BigIP will nevertheless issue a TCP reset immediately after the established 3WHS, so the connection should not stay "up". If you have a fastL4 virtual, the BigIP will instead reply with a TCP Reset to the first SYN packet of the client, so the connection will not even establish. See https://support.f5.com/csp/article/K9812 for details:

     

    When all pool members are unavailable due to being disabled, forced offline, or down, the BIG-IP RST behavior varies slightly depending on the virtual server type. If the virtual server references a TCP profile (Standard virtual server type), the system allows the three-way TCP handshake to complete before sending the TCP RST to the client. If the virtual server references a FastL4 profile, the system sends a TCP RST packet in response to a connection attempt. The TCP RST packet is sent on the client side of the connection, and the source IP address of the reset is the relevant virtual server IP address.