IIS Based Application Load balancing Issue - F5
Hi Team, We are attempting to deploy an IIS Windows-based application on F5, but it is not functioning,we are receiving only the health check responses from LB to backend server, but not any actual requests from the load balancer. Could you please assist us with any necessary steps we need to follow while configuring F5 for an IIS Windows-based application? For your information, we have applied an SSL certificate on the backend server, but not on the load balancer. Could this be causing an issue? Additionally, it would be very helpful if you could share the recommended load balancing algorithm for IIS Windows. Thanks & Regards, Shivam Aggarwal78Views0likes3CommentsIntermittent Net::ERR_CONNECTION_RESET Error and Incomplete Loading over HTTPS
I have an F5 load balancing setup configured with two servers. My MVC web application, which incorporates Kendo UI, Jquery, and bootstrapping, is hosted on an IIS server with an SSL certificate. However, when accessing the application via HTTPS from outside the server, it often or sometimes results in a 'net::ERR_CONNECTION_RESET' error, with intermittent failures to load javascript and CSS files to the client browser. Strangely, upon reloading the page, the assets load properly, and the page functions as expected. This issue did not occur when the application was accessed via HTTP, where it worked properly without any issues. What could be the reason behind this problem?434Views0likes2Commentsstalled/blocked request
Hi, My short topology: client browser->F5->IIS servers I have a .Net web application. Randomly some request is in stalled/blocked state in browser. For example: I can see a request that spend 7 minutes in stalled state and then it is processed less than 1 second. I can't see high cpu, memory, connection load at this time. The peak connection is 4k, but I think it is not too high. At same time I can see lot of success request also. I think the request is waiting for something on my F5, but I don't know for what. Could anyone help me how can I detect the reason? My opinion is that I reached the connection limit but I can see any error message in log about it. How can I check it? Thanks.88Views0likes3CommentsLTM Monitoring IIS and Webserver Binding
Hello, we've got a VS for 2 MS IIS Webserver. Question: if I configure the Pool with regular Nodes, the Monitor connects the Nodes with the IP Adress, right? Then I've got a problem with the Webserver-Binding (only Bindings for hostname and Website-Name) What if I configure the Pool with fqdn-Node? Is it sure, Monitor connects with hostname? when I make from BIG-IP a curl -k https://webbvk1.bvk.int/Smoke-Test I get the Response ...Smoketest... but with a Pool with webbvk1.bvk.int and webbvk2.bvk.int as fqdn-Node, the members are marked as down. webbvk1 & 2 are CNAMEs Send-String: HEAD /Smoke-Test HTTP/1.0\r\n\r\n Receive-String: Smoketest any Idea, where I could look for? Or a Problem with the IIS? Thank youSolved724Views0likes6CommentsCRM - Cross Domain Functionality Through F5
Hi, Our topology looks like this CRM_SERVER := internal.domain.com ^^ F5 := external.domain.com \ Azure plugin/SaaS service We are having issues where the external Azure plugin, in this case Click Dimensions, is raising an authentication exception when processing CRM data. We have the following iRule in place to handle header and payload rewrites. when HTTP_REQUEST { if { [HTTP::header host] eq "crmdev.external.com" } { HTTP::header replace Host "crmdev.internal.com" } Disable the stream filter for all requests STREAM::disable LTM does not uncompress response content, so if the server has compression enabled and it cannot be disabled on the server, we can prevent the server from sending a compressed response by removing the compression offerings from the client HTTP::header remove "Accept-Encoding" } when HTTP_RESPONSE { Rewrite the Location header replacing the internal hostname with the external hostname HTTP::header replace Location [string map -nocase {"crmdev.internal.com" "crmdev.external.com"} [HTTP::header Location]] only do this for text-based responses if { [HTTP::header Content-Type] contains "text" } { establish the stream expression STREAM::expression {@http://crmdev.internal@https://crmdev.external@ @https://crmdev.internal@https://crmdev.external@} STREAM::expression {@crmdev.internal@crmdev.external@} enable stream processing STREAM::enable } } As the F5 is in SSL offload mode, do we need to include anything to handle the HTTP 401 Challenge/Response to the IIS server? Or has anyone experienced similar issues where the F5 acts as the external face for applications on an internal domain?355Views0likes1CommentTraffic Policy to Split Content Between IIS Server and Cloud Provider - unexpected behavior
We are in the process of moving a website from an IIS web server farm out to a different cloud hosting provider. The root of the rewritten site will be on the cloud servers. Since not all of the old legacy applications have been rewritten, we will still be serve up some of the legacy web applications from the old IIS servers. To achieve this, we are using the following: VIP with a default pool "Cloud_Provider" . That pool contains the IP address of that provider. VIP has a Traffic Policy associated with it that has a rule of: Match all of the following conditions:HTTP URI path starts with any of: /oldapp1 at request time Do the following when the traffic is matched:Forward traffic to pool "IIS_pool" The following scenerios work as expected and correctly serve up the web content: https://HostName.com/(this successfully loads the site from the cloud provider) https://HostName.com/oldapp1(this successfully loads the legacy app from the IIS Servers) However...If we first go to https://HostName.com/oldapp1and successfully load that,then we remove "/oldapp1" from the address bar and hit Enter, it attempts to load the root of the site in IIS. Since there is no more root site (it is now living on the cloud provider as a rewritten site), it sees no content and spits out a 403 Forbidden message. What we are trying to solve is, why when running through that second scenerio, is the traffic not going through the Traffic Policy again and seeing "this request is not foroldapp1"so I will not forward the traffic... I will just use the default pool. Troublshooting steps taken so far: Tried changing the Persistence Profile on the VIP to: source_address, ssl, cookie, none. Put an index.html file at the root of the IIS web server and had it redirect to https://HostName.com. That resulted in an endless loop because it never left the IIS server to go back through the VIP. This is running on 15.1.5.1, with ASM.Solved2KViews0likes2CommentsCan someone take a look and make sure I understand this right about reverse proxy
Preface: Yes I know not a whole lot but I'm trying. If someone could just take a look at this and maybe it will help me find what piece I am missing. We have an internal server that needs to be accessed on the outside, but they don't want it actually touching the internet so we run it through the BIG-IP F5 LTM. The internal IIS has an internal IP and an external IP assigned. The DNS entry is bound to the External IP address. A lot of what I setup has been copied from a currently working site that utilizes this exact same process. From my understanding the connection "route" is as follows: Internet-->ExtIP-->F5virtualIP-->IntIP The External IP gets natted on the firewall to the F5 internal IP of the virtual server, and then the F5 virtual server is linked to the actual internal server IP. We have access rules in place to allow public access to the external IP as well as the F5 IP. There are NAT rules in place that *should* point anyone going to the external IP towards the F5 address, and then through that to the internal server. There's an F5 rule in place that redirects from http to https as well. Internally, on my work PC, I can navigate to the site via it's FQDN. Externally though, I get a Not Secure Site message(we haven't gotten the cert in place yet so that is expected), but then after a while of trying to load, we receive an ERR_CONNECTION_RESET page and it can't load. I feel like there is something I am missing but I just can't think of what it is. If anyone has any ideas I will be eternally grateful. Thank you in advance.606Views0likes2CommentsHow to seperate web servers in same IIS
Hi, How can I make different virtual servers for each www server in same IIS server. Should I write DNS name in virtual server destination address? IIS server : 192.168.1.1 xyz.com pool has node : 192.168.1.1 abc.com pool has node : 192.168.1.1384Views0likes1CommentSNAT / X-FORWARD-FOR breaks HTTPS connection
We are trying to create an iAPP with SSL passthrough and X-FORWARDED set but when we enable SNAT for the X-FORWARDED-FOR (HTTP profile or iRule X-FORWARDED-FOR) the connection seems to stop passing through to our backend IIS pool (nothing logged in the IIS logs). We have looked through a few guides but it feels like we are missing something or there is an underlying setup flaw with our F5. Edge / Chrome give the following err_connection_reset It would seem the minute we enable either; a HTTP Profile, an SSL Profile or enable SNAT the site stops working I'm sure you will need more info from me, as I'm relatively new to F5's let me know what you need and I'll post the details inSolved886Views0likes2CommentsIIS behind Big IP Windows Authentication
Hi everyone, I'm trying to load balance a couple of IIS web servers for a particular application. The website is configured with Windows Authentication. If i try to access the webpage directly to a server node , i'm able to get the content without any issues. Now if i tried to access the webpage through the F5 Virtual Server, i'm getting the credentials popup window. How can i accomplish this without? regards760Views0likes1Comment