Forum Discussion

Dayesh_263997's avatar
Dayesh_263997
Icon for Nimbostratus rankNimbostratus
Dec 06, 2018
Solved

Client request not hitting the VIP.

Hello Team,

 

The client is initiating a request on HTTP/HTTPs and needs to access contents from the backend server on port 5432.

 

Line layout :

 

Client---HTTP--->VIP(VS listening on port 80)---Auto-map->----->Nodes (Port 5432)

 

I have configured the VS listening on port 80 and nodes on port 5432. Port translation is enabled.

 

Importantly, the client is able to ping the VIP IP.

 

As soon as I disable the VS, client's access to HTTP stops (i.e connection refused). On enabling it, HTTP access is through but I don’t see any traffic statistics on BIG-IP. This surely confirms, traffic is hitting BIG-IP, however, traffic statistics contradict this fact.

 

Can you advise further troubleshooting on this scenario?

 

Thanks,

 

Dayesh

 

application delivery
BIG-IP
LTM
  • pushkar_misra_2's avatar
    pushkar_misra_2
    Dec 15, 2018

    If you could post your configs, that would help. Please see if you are using SNAT or two arm deployment? If using SNAT, make sure the SNAT IP can reach the backend servers. If not using SNAT, snat exception, make sure to check the servers are configured with F5 as gateway.

     

    Check the routes F5 is taking to servers. ip route get serverip

     

    issue telnet from F5 telnet serverip port

     

    I you run capture with -s0 option it would capture the backend traffic and you can see if the TCP handshake is completing or not.

     

4 Replies

Sort By
  • Philip_Jonsson's avatar
    Philip_Jonsson
    Icon for MVP rankMVP
    Dec 06, 2018

    Hey Dayesh

    I'm afraid ping is not a sufficient tool to test this. You could have a global policy that allows ping but blocks HTTP to that particular VS. That way you can ping the VS but you will not be able to access the VS or generate statistics.

    The best way to actually make sure routing and firewall policies are correct, run telnet to the VS and define the port 80. For instance:

    telnet [VS IP] 80

    If it's not successful, then you'll know that there is something is not allowing the traffic to the VS. If it's successful you will know that traffic reaches the VS and it should generate statistics. In this case there is something on the BIG-IP that prohibits the traffic.

    Also, you can perform a tcpdump on the BIG-IP while doing it and see the traffic hitting the VS in real time. Just log on to SSH of the BIG-IP and run the following command:

    tcpdump -i 0.0 host [VS IP]

    I hope this helps!

    Let us know how it goes. 🙂

  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Dec 06, 2018

    Hi,

    Can you try to reach the backend from CLI:

    curl -i http://1.1.1.1:5432/uri -H "Host: myapp.domain.com"

    Where:

    • 1.1.1.1 will be your backend IP
    • myapp.domain.com will be hostname using to reach your app
    • and uri will be the uri of your app.

    It will allow you to check if you receive anything body/header.

    keep me update.

    regards,

  • pushkar_misra_2's avatar
    pushkar_misra_2
    Icon for Altocumulus rankAltocumulus
    Dec 15, 2018

    If you could post your configs, that would help. Please see if you are using SNAT or two arm deployment? If using SNAT, make sure the SNAT IP can reach the backend servers. If not using SNAT, snat exception, make sure to check the servers are configured with F5 as gateway.

     

    Check the routes F5 is taking to servers. ip route get serverip

     

    issue telnet from F5 telnet serverip port

     

    I you run capture with -s0 option it would capture the backend traffic and you can see if the TCP handshake is completing or not.

     

    • Dayesh_263997's avatar
      Dayesh_263997
      Icon for Nimbostratus rankNimbostratus
      Dec 17, 2018

      Hi Pushkar,

       

      Traffic group was configured to select adjacent LTM as the active device. I can see the traffic hitting that LTM now with accurate statistics.

       

      Things are working fine now as expected. Thanks for your response.

       

      Regards,

       

      Dayesh