How to log HTTP/2 reset_stream
Hello, We are currently in a meeting to prepare for HTTP/2 DDoS attacks. What we would like to do is log the client’s IP address (either local or remote) whenever an HTTP/2 RESET_STREAM is received. Is there any way to achieve this? Would it be possible to implement using an iRule? Thank you.Can't change sync type or failover after tenant upgrade.
I made a mistake that I didn't think in the end would matter, but here's what I did. I had previously upgraded this tenant pair to 17.1.3. Everything was fine, and I intended to install on another pair but I installed on the other boot location of one that I had already installed. I didn't think this was an issue as I would just not activate that boot location. However, I couldn't force the Active member to Standby. It was greyed out. I thought that maybe I should boot to that new location because maybe there was something that needed to complete to allow me to fail over between the members. That made it worse because I couldn't change the sync type back to Automatic with incremental sync. So naturally, I booted to the previous partition because it seemed to be at least better, but now I seem to be digging a hole I can't get out of. Where it stands now: The pair is set to sync type "Manual with Incremental Sync" Member1 is standby and says "Not All Devices Synced" Member2 is active and says "Changes Pending" On the Standby Member1, I can change the sync type, but I haven't. On the Active Member2, I can't change the sync type or force it to standby. I have a ticket open but as this is a live system, I pursuing all avenues.F5 BIG-IP Multi-Site Dashboard
A comprehensive real-time monitoring dashboard for F5 BIG-IP Application Delivery Controllers featuring multi-site support, DNS hostname resolution, member state tracking, and advanced filtering capabilities. A 170KB modular JavaScript application runs entirely in your browser, served directly from the F5's high-speed operational dataplane. One or more sites operate as Dashboard Front-Ends serving the dashboard interface (HTML, JavaScript, CSS) via iFiles, while other sites operate as API Hosts providing pool data through optimized JSON-based dashboard API calls. This provides unified visibility across multiple sites from a single interface without requiring even a read-only account on any of the BIG-IPs, allowing you to switch between locations and see consistent pool, member, and health status data with almost no latency and very little overhead. Think of it as an extension of the F5 GUI: near real-time state tracking, DNS hostname resolution (if configured), advanced search/filtering, and the ability to see exactly what changed and when. It gives application teams and operations teams direct visibility into application pool state without needing to wait for answers from F5 engineers, eliminating the organizational bottleneck that slows down troubleshooting when every minute counts. https://github.com/hauptem/F5-Multisite-DashboardIdentify which virtual servers are using a specific SSL certificate
We use a wildcard SSL certificate for our QA sites. There are many of them. I am renewing the SSL cert but have no idea which Virtuals are using it. Is there an easy way to determine this other than checking each and every virtual, listing the Client-ssl profile and then looking up the profile to see what certificate is being used?
Users account sessions mixed up..
Hi < I have been asked to look into a very strange issue. And not sure from where to start. I dont think it is happening due to Big IP. But could someone please provide a insight. Only persistence cookie is sent by big ip. Session and auth cookie is sent by back end servers. Although Big IP just add 'secure' parameter into all those cookies. Summary of the issue is below. We need your help on this critical matter. A user has reported that for some reason, her sessions got mixed up. That is, she logged under Username JFSM first and went to My Billing page to perform a function. Then she logged as JSMIREZ and was going to the My Billing Page for the new account. Instead, of getting to right page, she was directed to the previous log-in’s Account Summary page. Now, she confirmed she was only using one browser session. Is there any chance that sessions can get mixed up from the big ip for the same browser? That is, somehow a prior page request can be re-sent to the current session? I know am grasping at straws here but I am not sure what are the possibilities. I do have to note that the way the site has been working is that when I open up a browser and log-in to a User Account, let’s call Account A. Then on the same browser, I open up a new window and try to log-in as Account B; I would still get the information for Account A. The reason being, that this is considered as the same session/browser and considers Account A as still active for this session and not Account B even if the requests were made from different windows/tabs. One thing for sure though, if there are multiple users hitting the servers from different browsers, is there any chance at all where their requests can get mixed up? That is, you can have Users A, B, and C all hitting the website at the same time. And each of them are using separate browsers from different ip addresses. Is there any chance that the load balancer would ever mix up their sessions where User A’s page requests will be returned to User C and User C’s requests are returned to User B enabling them to see someone else’s account?
F5 upgrades
We are upgrading F5 tenants from 17.1 to 17.5. We have Two R-series pairs at each data center ( ex:main and colo) Within the data center, they are in HA active standby and the 4 are in a GSLB group . Each host has one tenant During the upgrade process, I disabled GTM Sync on the F5 that is going to be upgraded. Is it recommended? I plan on having traffic moved to this active box at ex colo from the other data center main, I won't be making any config changes . After the applications move to this side, LTM pools show up on this side and global availability will have the upgraded side up. just want to make sure, if that is disabled, do we need to leave them disabled and sync them after all the 4 F5s are upgraded? during this process, can we make changes with the data center on LTM pools? Thank you
