LTM
19097 Topicsoneconnect (Source Prefix Lengt = None)
Hello Folks, currently I am struggling with the following setting in OneConnect-Profile. Source Prefix Length = None I couldn't found any information about "None". Every whitepaper is talking about 0 or other specific masks. Is "None" == "0" == "0.0.0.0" or is "None" disable connection reuse although the profile was set on the VS? Thanks a Lot rschwarzSolved35Views0likes1CommentUnable to download files greater than 4GB. Running version 15.1.5.1
Hi All, Could you please let me know if there is any known bug in F5 BIG-IP version 15.1.5.1 related to downloading files larger than 4GB. We are able to successfully download files up to 3.99GB, but anything over 4GB fails to even initiate. We’ve already tried modifying both the TCP and HTTP profiles without success. Additionally, we tested the Unchunk and Rechunk options, but that did not resolve the issue either.66Views0likes3CommentsKerberos SSO without APM?
Hi, I have a question regarding Single Sign-On with kerberos. I have a pair of Virtual BigIPs on a Viprion-System running in Active/Standby. The systems are connected one-armed and therefor using SNAT. I am loadbalancing several servers using the LTM...quite easy, no problems. Now the application guys would like to use our active directory for a single sign-on to these servers. This works fine, if you address one of the pool-servers directly, but not if you use the virtual server. I think the problem is the SNAT. When crossing the LTM, the source address of the packet is changed. When the kerberos-ticket arrives at the server, the IP inside the ticket is different from the source ip because of SNAT. Is that right, or is there another reason? Would running the LTM in two-armed-mode without SNAT solve my problem? Or is the only way to buy an APM license and let the BigIP talk to the active directory? Unfortunately I have only little knowledge in SSO/Kerberos/AD, but I hope I could make myself clear. Thanks in advance Regards, ThorstenSolved836Views0likes6CommentsSSH Proxy Problem: Real Server Auth
Hi, while playing around with the SSH proxy feature, I'm encountering issues with the validation of the Real Server Auth key. I've configured the profile as described in https://support.f5.com/kb/en-us/products/big-ip-afm/manuals/product/network-firewall-policies-implementations-12-1-0/13.html. Unfortunately I got an error message in /var/log/sshplugin: err : SSHPLUGIN: sshplugin_2|SSHPlugin|ssh_setup_serverside|Core|the backend ssh server does not have a public key that matches the configuration! (0) Erroring out of this connection. I've checked and doublechecked the host key using ssh-keyscan and copied the key string into the field "Real Server Auth". The format of the key looks exactly like the one from the manual, except that my key is a one-liner instead of the block view in the manual. The manual shows the key in block view AAAAB3NzaC1yc2EAAAADAQABAAABAQCziS6yavPpFuRjLP9hzRiEBcVgLDynoW qNMuwCrOREkSiDqWqFRrydFCGy6Z1WwwJuDMIw5h3sIuqtOo78zd6pBabXpj0Q LUyLtGx80Oe3vInpwxvG2/YX9KaGjofkasZJ+tOqoOe5QscnUYr7Iw6CEuo2dB VIZyL/o1IyTvDfL8+yXO4vPzadmL0gvV1F56feRVsCF0HUrhWwdrQ6CpIpX6ac sY0HayrhOGPmVF4qRz7fLySHJ5XQz5IKXJRNHJEbXx2tiV1TuQlhz8gOMqMp2I iSqyKDcUTk2Oy0fPYkNAWPlifq7GplYkit85EL5UCgtHf595rqibOQJWFAAzHF while mine looks like AAAAB3NzaC1yc2EAAAADAQABAAABAQCziS6yavPpFuRjLP9hzRiEBcVgLDynoWqNMuwCrOREkSiDqWqFRrydFCGy6Z1WwwJuDMIw5h3sIuqtOo78zd6pBabXpj0QLUyLtGx80Oe3vInpwxvG2/YX9KaGjofkasZJ+tOqoOe5QscnUYr7Iw6CEuo2dBVIZyL/o1IyTvDfL8+yXO4vPzadmL0gvV1F56feRVsCF0HUrhWwdrQ6CpIpX6acsY0HayrhOGPmVF4qRz7fLySHJ5XQz5IKXJRNHJEbXx2tiV1TuQlhz8gOMqMp2IiSqyKDcUTk2Oy0fPYkNAWPlifq7GplYkit85EL5UCgtHf595rqibOQJWFAAzHF Hopefully this doesn't make a difference. I even don't know how to turn on debug logging for sshplugin. Maybe this would help. Any ideas? Greets, svs361Views0likes2Commentsusing '--resolve' in the pool monitor health check
Hello, I am checking if it's possible to add the option '--resolve' in the health check monitor and avoid using a custom monitor (which consumes too much memory). For example: curl -kvs https://some_site_in_the_internet.com/ready --resolve some_site_in_the_internet.com:443:196.196.12.12 I know you can use curl -kvs https://196.196.12.12/ready --header "host: some_site_in_the_internet.com" But the path to the servers has some TLS requirements that' does not work. Any ideas are welcome Thanks50Views0likes1CommentHA between rSeries tenant and iSeries appliance.
According to F5 documentation, the BIG-IP system supports either homogeneous or heterogeneous hardware platforms within a device group. I want to confirm if anyone has tried to put rSeries tenants and iSeries appliances in the same cluster? Obviously, I understand they will need to be on same version and of course vlans will be same on both. If you have tried this before, what were your challenges and how did you overcome them? I am considering this approach because it makes migration easier and seamless.73Views0likes2CommentsUniversal Persistence w. AS3 vs. SCF - the same but not the same
Hi community, I have an odd issue. When I create the following config manually or with SCF the Universal Persistence works. I get records in the persistence table. root@(ltm-apm)(cfg-sync Standalone)(Active)(/Common)(tmos)# show ltm persistence persist-records Sys::Persistent Connections universal 12345abcde 10.100.155.182:80 10.100.153.127:80 (tmm: 1) universal 12345abcde 10.100.155.182:80 10.100.153.127:80 (tmm: 0) This is the config as SCF (at least the relevant parts of it): ltm virtual vs_persistence_test { destination 10.100.155.182:http ip-protocol tcp mask 255.255.255.255 persist { uie_jsessionid { default yes } } pool pl_persistence_test profiles { f5-tcp-progressive { } http { } } serverssl-use-sni disabled source 0.0.0.0/0 source-address-translation { pool snat_pool_internal type snat } translate-address enabled translate-port enabled vs-index 57 } ltm persistence universal uie_jsessionid { app-service none defaults-from universal rule rule_uie_jsessionid timeout 300 } ltm rule rule_uie_jsessionid { when HTTP_RESPONSE { if { [HTTP::cookie exists "JSESSIONID"] } { persist add uie [HTTP::cookie "JSESSIONID"] } } when HTTP_REQUEST { if { [HTTP::cookie exists "JSESSIONID"] } { persist uie [HTTP::cookie "JSESSIONID"] } } } Do I deploy the same with AS3, it doesn't seem to work. I cannot see any persistence records. { "$schema": "https://raw.githubusercontent.com/F5Networks/f5-appsvcs-extension/main/schema/latest/as3-schema.json", "class": "AS3", "action": "deploy", "declaration": { "class": "ADC", "schemaVersion": "3.0.0", "remark": "Session persistency w JSESSIONID", "universal_persist_jsessionid": { "class":"Tenant", "App01": { "class": "Application", "service_http_80": { "persistenceMethods": [{ "use": "uie_jsessionid" } ], "pool": "pl_persistence_test", "translateServerAddress": true, "translateServerPort": true, "class": "Service_HTTP", "profileTCP": { "bigip": "/Common/f5-tcp-progressive" }, "profileHTTP": { "bigip": "/Common/http" }, "virtualAddresses": [ "10.100.155.182" ], "virtualPort": 80 }, "pl_persistence_test": { "members": [ { "servicePort": 80, "serverAddresses": [ "10.100.153.126", "10.100.153.127" ] } ], "monitors": [ { "bigip": "/Common/http" } ], "class": "Pool" }, "uie_jsessionid": { "duration": 300, "class": "Persist", "iRule": "persist_irule", "persistenceMethod": "universal" }, "persist_irule": { "class": "iRule", "iRule": { "base64": "d2hlbiBIVFRQX1JFU1BPTlNFIHsKICBpZiB7IFtIVFRQOjpjb29raWUgZXhpc3RzICJKU0VTU0lPTklEIl0gfSB7CiAgICBwZXJzaXN0IGFkZCB1aWUgW0hUVFA6OmNvb2tpZSAiSlNFU1NJT05JRCJdCiAgfQp9CndoZW4gSFRUUF9SRVFVRVNUIHsKICBpZiB7IFtIVFRQOjpjb29raWUgZXhpc3RzICJKU0VTU0lPTklEIl0gfSB7CiAgICBwZXJzaXN0IHVpZSBbSFRUUDo6Y29va2llICJKU0VTU0lPTklEIl0KICB9Cn0=" } } } } } } FYI, I decided to use base64 for the iRule in AS3. However, if I do a diff of the iRules in plaintext - they are the same. BIG-IP version: 17.1.2.1 Now my questions are. Am I missing something here? Did anybody come accross the same issue? Why is it not working? Thanks for your help DanielSolved84Views0likes5CommentsHorizon View iApp - Big-IP 17.5
I have a client deploying an r4650 pair. The plan is for it to handle Exchange, LDAPS & Horizon View. I’m in the process of initial setup on the pair of boxes now. It’s been a long time since I've deployed Horizon View on F5. I see that the iApp is still maintained so yay! Question: is the current 1.5.9 version of the iApp supported in Big-IP 17.5? The KB article states 17.1 but the article hasn’t been updated in a while. F5 recommends the latest version of 17.5 but I don't want to hit any snags as we deploy. Thanks in advance, Matt139Views0likes2CommentsMgmt Interface Shows Up as TMM
So I have an F5-VE I'm working on that the Mgmt doesn't ping or accept SNMP requests. I opened a case with F5 and they say my 1.0 interface and my Mgmt interface has the same MAC. tmsh show sys mac-address | grep interface 00:50:XX:XX:XX:XX net interface 1.2 mac-address 00:50:XX:XX:XX:XX net interface 1.1 mac-address 00:50:XX:82:b5:aa net interface mgmt mac-address 00:50:XX:82:b5:aa net interface 1.0 mac-address 00:50:XX:XX:XX:XX net interface 1.3 mac-address I have never seen anything like this. Has anyone ever seen anything like this and what did you do to fix? My plan is to remove the 1.0 boot and see what happens. Add it back if needed. From all the documents I've looked at when that interfaces is created in VMware it should make a TMM interface is should make the Mgmt interface in the VLAN we specify when building it from the OVA.28Views0likes1Comment