For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

smp_86112's avatar
smp_86112
Icon for Cirrostratus rankCirrostratus
Mar 15, 2012

Wildcard VS Priority Processing

Hi. I am trying to diagnose why an SSH connection is getting terminated after the default idle timeout in the fastL4 profile (300s). The connection from the client is received on the "external" VLAN. ...
config
design
nitass's avatar
nitass
Icon for Employee rankEmployee
Mar 16, 2012
it seems working correctly for me.

172.28.19.170 is client.

200.200.200.101 is sshd.

200.200.200.10 is selfip (snat automap). 

[root@ve1023:Active] config  b version|grep -iA 1 version
BIG-IP Version 10.2.3 112.0
Final Edition

[root@ve1023:Active] config  b virtual list
virtual bar {
   translate service disable
   ip forward
   snat automap
   destination any:22
   mask 0.0.0.0
   ip protocol 6
   profiles fastL4_20s {}
}
virtual wildcard {
   ip forward
   snat automap
   destination any:any
   mask 0.0.0.0
   profiles fastL4_10s {}
}
[root@ve1023:Active] config  b profile fastL4_10s list
profile fastL4 fastL4_10s {
   defaults from fastL4
   idle timeout 10
}
[root@ve1023:Active] config  b profile fastL4_20s list
profile fastL4 fastL4_20s {
   defaults from fastL4
   idle timeout 20
}

[root@ve1023:Active] config  tcpdump -nni 0.0 port 22 and not host 172.28.19.80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on 0.0, link-type EN10MB (Ethernet), capture size 108 bytes
06:49:06.357027 IP 172.28.19.170.58504 > 200.200.200.101.22: S 1891381090:1891381090(0) win 5840 
06:49:06.357175 IP 200.200.200.10.58504 > 200.200.200.101.22: S 1891381090:1891381090(0) win 5840 
06:49:06.357871 IP 200.200.200.101.22 > 200.200.200.10.58504: S 3959009223:3959009223(0) ack 1891381091 win 5792 
06:49:06.357881 IP 200.200.200.101.22 > 172.28.19.170.58504: S 3959009223:3959009223(0) ack 1891381091 win 5792 
06:49:06.360748 IP 172.28.19.170.58504 > 200.200.200.101.22: . ack 1 win 46 
06:49:06.360759 IP 200.200.200.10.58504 > 200.200.200.101.22: . ack 1 win 46 
...
06:49:10.150820 IP 172.28.19.170.58504 > 200.200.200.101.22: . ack 2205 win 79 
06:49:10.150832 IP 200.200.200.10.58504 > 200.200.200.101.22: . ack 2205 win 79 
06:49:32.644079 IP 200.200.200.10.58504 > 200.200.200.101.22: R 1925:1925(0) ack 2205 win 0
06:49:32.644099 IP 200.200.200.101.22 > 172.28.19.170.58504: R 2205:2205(0) ack 1925 win 0