ltm
19117 TopicsTCP Profile with Verified Accept enabled and three-way TCP handshake
Hi, I'm trying to understand exactly how the Standard virtual server processes connections using the full proxy architecture works when Verified Accept is enable on the TCP profile. With Verified Accept disabled, the three-way TCP handshake occurs on the client side of the connection before the BIG-IP LTM system initiates the TCP handshake on the server side of the connection. Only when the client side TCP handshake is complete, LTM chooses a pool member and start the server side three-way TCP handshake. When Verified Accept is enabled, "the system sends the server a SYN packet, and waits for the server to respond with a SYN-ACK, before responding to the client's SYN with a SYN-ACK" (K98387022: TCP Profile with Verified Accept enabled). My question : when Verified Accept is enabled the server side TCP handshake is completed before or after the client side TCP handshake ? I'm confusing because in the F5 documentation this behavior is not clearly described and because in the document K98387022 I read this example : For example, given an HTTP virtual server, the order of events changes. Verified Accept disabled: CLIENT_ACCEPTED -> HTTP_REQUEST -> LB_SELECTED -> SERVER_CONNECTED -> HTTP_REQUEST_SEND Verified Accept enabled: CLIENT_ACCEPTED -> LB_SELECTED -> SERVER_CONNECTED -> HTTP_REQUEST -> HTTP_REQUEST_SEND If I'm not mistaken, CLIENT_ACCEPTED means that the connection has been established and that the three-way handshake is complete. So, in this example the client side handshake is completed before the server side handshake in both cases ? Thanks for your help DiegoSolved69Views1like4CommentsLB Connection Limit Detection Method
We have set a connection limit on the load balancer. If there is a way to detect when the upper limit of the connection limit is exceeded, please let us know. We are considering detection via log monitoring, but we would like to confirm if there are other methods available.38Views0likes2CommentsSingle LTM with multiple GTM domains
I am currently working on a Datacenter migration and we are re-IP'ing everything and rebuilding all the network appliances. I am working out the BEST, least impactful, way to migrate the GTM appliances to the new DC's. Here is the overall situation. Everything is the same version running 15.x.x with a mix of rSeries hardware running VE's and iSeries hardware also running VE's. Existing DC's: GTM Domain with two GTM's in different DC's Multiple LTM's all joined to the GTM New DC's: Two GTM's in different DC's, blank configuration Multiple LTM's all joined with the existing DC GTM's I know that I can add the new GTM's to the existing DC GTM domain, let them sync up, then update the NS records to migrate the DNS flows over to the new DC, but that also sync's over all the technical debt and limits my pre-testing abilities. I would like to setup a new GTM Domain in the new DC, build some automation for the WideIP / Pool creation, and manually review / rebuild all the necessary records in the new DC. My hangup is that this is ONLY possible if the LTM appliance can join multiple GTM domains. Can a single LTM appliance join multiple GTM domains and report status to multiple appliances? I don't have an easy way to build a test environment and build this out with VE's and validate so I am hoping for some input from the community.71Views0likes2CommentsiRule Pool member(s) offline or disabled
Hello community, is there any way to check if the pool members offline/down (e.q. network or server error) or disabled (by a monitor during a maintenance) using a iRule? The background would be the delivery of an event-specific user information page. Network or server error => Error Page with Helpdesk-Support infos Maintenance => simply maintenance site Thanks & BR RenéSolved80Views0likes4CommentsCan one create one virtual server with two pool members with multiple services running on it?
Hi, we have servers with multiple services running on it. Can we just create one virtual server with a customized port list. Can create a tcp port list under shared object? Can someone please advise? thanks in advance!Solved116Views0likes8CommentsProxy Protocol v2 Initiator
Problem this snippet solves: Proxy Protocol v1 related articles have already been posted on DevCentral, but there is no v2 support iRule code available. A customer wanted to support Proxy Protocol v2, so I wrote an iRule code for supporting v2. Proxy protocol for the BIG-IP (f5.com) How to use this snippet: Back-end server must handle Proxy header prior data exchange. Code : when CLIENT_ACCEPTED { # DEBUG On/Off set DEBUG 0 set v2_proxy_header "0d0a0d0a000d0a515549540a" # v2 version and command : 0x21 - version 2 & PROXY command set v2_ver_command "21" # v2 address family and transport protocol : 0x11 - AF_INET (IPv4) & TCP protocol set v2_af_tp "11" # v2 Address Size : 0x000C - 12 bytes for IPv4 + TCP set v2_address_length "000c" # Get TCP port - 2 byte hexadecimal format set src_port [format "%04x" [TCP::client_port]] set dst_port [format "%04x" [TCP::local_port]] # Get Src Address and convert to 4 byte hexadecimal format foreach val [split [IP::client_addr] "."] { append src_addr [format "%02x" $val] } # Get Dst Address and convert to 4 byte hexadecimal format foreach val [split [IP::local_addr] "."] { append dst_addr [format "%02x" $val] } # Build proxy v2 data set proxy_data [binary format H* "${v2_proxy_header}${v2_ver_command}${v2_af_tp}${v2_address_length}${src_addr}${dst_addr}${src_port}${dst_port}"] if { $DEBUG } { binary scan $proxy_data H* proxy_dump log local0. "[IP::client_addr]:[TCP::client_port]_[IP::local_addr]:[TCP::local_port] - proxy_data dump : $proxy_dump" } } when SERVER_CONNECTED { TCP::respond $proxy_data }1.3KViews2likes2CommentsFailing over of a Virtual F5 configuration to another location using Zerto restore process
We are preparing a process for disaster recovery to use Zerto to copy a server had has our virtual F5 configuration to another server at another facility. What needs to be completed by means of moving license keys and changing MAC to recognize the F5 configuration.768Views1like3CommentsAS3 declaration to set cookie to preferred
Hello, I am deploying a new environment with AS3, lovely 🙂, but I am having issues setting the cookie persistence option cookie-encryption to preferred. By default, it is set to required. I checked the AS3 documentation but could not find how to do this. Any ideas? Thanks79Views0likes1CommentHigh availability Blade
Hello everyone, I would like to know if is possible to configuire high availability on two Blade BX110. At the moment I have only one blade where there are all Tenants and, the capacity of using it, is 85% . The customer want to buy another Blade but, it wants that for every Velos, te two blades build a unique partition. Is it possible to do it by considering that in one blade there are all Tenants in a production environment ? Which type of impact there will be ? To sum up could i configure both blade in high availability with no run the risk to block the services of the Tenants ? I have read that is possible to make a setup of the blades but is not mentioned that this activity could provide, if on the one are presents Tenants, to reset the configuration. Many thanks in advanced for your help. Awaiting your news,76Views0likes1CommentError While Adding Peer Devices to Local Trust Domain
Hello, I am attempting to create a DSC between two 12.1.5.3 VEs using the KB https://support.f5.com/csp/article/K13639. I execute the following command to add the peer devices to the local trust domain: modify /cm trust-domain /Common/Root ca-devices add { SECOND_MANAGEMENT_IP_REDACTED } name SECOND_HOSTNAME_REDACTED username admin password SECOND_PASSWORD_REDACTED For some reason, when executed, I receive the following error: std exception: ([xmlHelpers.cpp:90 getXPathValue] expected 1 node for //faultstring, got 0), exiting... I receive the same error when processing the command through the TMUI as well. Self IPs in question are both configured as /30 (192.168.3.1 and 192.168.3.2), and 192.168.3.1 is locked to allow udp:1026 only where 192.168.3.2 also temporarily has tcp:443 allowed in addition as this is required for this step. I have tried setting both Self IPs to Allow Default to see if that was the issue, and it is not. I have also attempted to use an incorrect password, and receive a 'std exception: (iControl authorization failed), exiting...' error, so I know it is not an authentication issue. Any thoughts? Thanks!Solved2KViews0likes2Comments