TCP Profile with Verified Accept enabled and three-way TCP handshake
Hi, I'm trying to understand exactly how the Standard virtual server processes connections using the full proxy architecture works when Verified Accept is enable on the TCP profile. With Verified Accept disabled, the three-way TCP handshake occurs on the client side of the connection before the BIG-IP LTM system initiates the TCP handshake on the server side of the connection. Only when the client side TCP handshake is complete, LTM chooses a pool member and start the server side three-way TCP handshake. When Verified Accept is enabled, "the system sends the server a SYN packet, and waits for the server to respond with a SYN-ACK, before responding to the client's SYN with a SYN-ACK" (K98387022: TCP Profile with Verified Accept enabled). My question : when Verified Accept is enabled the server side TCP handshake is completed before or after the client side TCP handshake ? I'm confusing because in the F5 documentation this behavior is not clearly described and because in the document K98387022 I read this example : For example, given an HTTP virtual server, the order of events changes. Verified Accept disabled: CLIENT_ACCEPTED -> HTTP_REQUEST -> LB_SELECTED -> SERVER_CONNECTED -> HTTP_REQUEST_SEND Verified Accept enabled: CLIENT_ACCEPTED -> LB_SELECTED -> SERVER_CONNECTED -> HTTP_REQUEST -> HTTP_REQUEST_SEND If I'm not mistaken, CLIENT_ACCEPTED means that the connection has been established and that the three-way handshake is complete. So, in this example the client side handshake is completed before the server side handshake in both cases ? Thanks for your help Diego
Single LTM with multiple GTM domains
I am currently working on a Datacenter migration and we are re-IP'ing everything and rebuilding all the network appliances. I am working out the BEST, least impactful, way to migrate the GTM appliances to the new DC's. Here is the overall situation. Everything is the same version running 15.x.x with a mix of rSeries hardware running VE's and iSeries hardware also running VE's. Existing DC's: GTM Domain with two GTM's in different DC's Multiple LTM's all joined to the GTM New DC's: Two GTM's in different DC's, blank configuration Multiple LTM's all joined with the existing DC GTM's I know that I can add the new GTM's to the existing DC GTM domain, let them sync up, then update the NS records to migrate the DNS flows over to the new DC, but that also sync's over all the technical debt and limits my pre-testing abilities. I would like to setup a new GTM Domain in the new DC, build some automation for the WideIP / Pool creation, and manually review / rebuild all the necessary records in the new DC. My hangup is that this is ONLY possible if the LTM appliance can join multiple GTM domains. Can a single LTM appliance join multiple GTM domains and report status to multiple appliances? I don't have an easy way to build a test environment and build this out with VE's and validate so I am hoping for some input from the community.
Failing over of a Virtual F5 configuration to another location using Zerto restore process
We are preparing a process for disaster recovery to use Zerto to copy a server had has our virtual F5 configuration to another server at another facility. What needs to be completed by means of moving license keys and changing MAC to recognize the F5 configuration.
AS3 declaration to set cookie to preferred
Hello, I am deploying a new environment with AS3, lovely 🙂, but I am having issues setting the cookie persistence option cookie-encryption to preferred. By default, it is set to required. I checked the AS3 documentation but could not find how to do this. Any ideas? ThanksHigh availability Blade
Hello everyone, I would like to know if is possible to configuire high availability on two Blade BX110. At the moment I have only one blade where there are all Tenants and, the capacity of using it, is 85% . The customer want to buy another Blade but, it wants that for every Velos, te two blades build a unique partition. Is it possible to do it by considering that in one blade there are all Tenants in a production environment ? Which type of impact there will be ? To sum up could i configure both blade in high availability with no run the risk to block the services of the Tenants ? I have read that is possible to make a setup of the blades but is not mentioned that this activity could provide, if on the one are presents Tenants, to reset the configuration. Many thanks in advanced for your help. Awaiting your news,
Problem with lets encrypt and redirect after update
Hi, we have updated our BigIP last week from 15.x to 17.1.1.4, since then we are not able to get certificates from lets encrypt, if there is the _sys_https_redirect iRule active on the Virtual Server. As an example, i have for the IP 1.2.3.4 (asdf123.info) two VS with port 80 and 443, on port 80 are two iRules mapped: lets_encrypt: when HTTP_REQUEST { if {[HTTP::has_responded]} {return} if { not ([HTTP::path] starts_with "/.well-known/acme-challenge/") } { return } set token [lindex [split [HTTP::path] "/"] end] set response [class match -value -- $token equals acme_responses] if { "$response" == "" } { log local0. "Responding with 404 to ACME challenge $token" HTTP::respond 404 content "Challenge-response token not found." } else { log local0. "Responding to ACME challenge $token with response $response" HTTP::respond 200 content "$response" "Content-Type" "text/plain; charset=utf-8" } } and _sys_https_redirect: # Copyright 2003-2006, 2012-2013, 2016, 2019. F5 Networks, Inc. See End User License Agreement ("EULA") # for license terms. Notwithstanding anything to the contrary in the EULA, # Licensee may copy and modify this software product for its internal business # purposes. Further, Licensee may upload, publish and distribute the modified # version of the software product on devcentral.f5.com. # when HTTP_REQUEST { HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri] } definition-signature tJY87UPbfpgQ3TPXqXhbCAgqIJhR1MvyFxXLTX/wNqmH+XV51tNkr8HWmv4PBq8hm6w7peLKj88shG+0RiX+yAMU31n6jS9vRcg0VKNPBWLTzu3Ic8abqyyY6XYgkMel+d9Sa8x+vakcuPcAZ0dnICHQiQFePjxYUD0XKwIrbGqQb8vEcU3HHbDaLoMQry4KDnV3s1crFpWXBZBo6esIdzM/s0jYncqZBNdTmIEH3ujEunmo2Jh9MBDhwfGKy1XwCfeeZvzk8b1J+HbRk7W/vbrRUewJZDt+Z13i9u/MbneAL4QXZgtjSxU2nN4GcZjWePUIm7oxc1nz9FGeNva1xg== This configuration had worked for years now, but since the update to 17.1.1.4 we get a "connection reset by peer" at requests for http://asdf123.info/.well-known/acme-challenge/30IpwjJqyA7LKANXCvu7gyN9txfYQOqzllBNC3ROPnY if i remove the _sys_https_redirect iRule, it works fine. Has anyone an solution for this problem?
