Forum Discussion

Ravi9_136822's avatar
Ravi9_136822
Icon for Nimbostratus rankNimbostratus
Mar 19, 2014

I-rule between VIPs on two different physical F5's

Hi All,

 

We have an i-rule which forwards request from F5 VIPA to F5 VIPB. VIPA is on F5 device in location A and VIPB is on another F5 device in location B.

 

VIPA: Bunch of servers under a pool, all listen on 80, the servers are in same location as of F5 VIPB: Bunch of servers under a pool

 

I-rule was written on VIPA to forward request either to VIPB or to it's own default pool.

 

when HTTP_REQUEST { set usessl 0 switch -glob [HTTP::path] { "/xyz/us/" - "/xyz/uk/" { snat xx.xxx.xxx.xxx set usessl 1 pool vipb-443} default { set usessl 0 pool defaultpool-80

 

} } } when SERVER_CONNECTED { if { $usessl == 0 } { SSL::disable } }

 

Pool vipb-443 has just one member that's VIPB with 443 port pool defaultpool-80 has bunch of servers in same location as of VIPA

 

I have a flow on a page hosted on VIPA which loads data from a page in VIPB and then comes back to pool members of VIPA for some other processing.The issue is when a http request is going thru this I-rule, the first part xyz/us that goes to VIPB is successful and in default path it throws error_inertnet_connection_reset.

 

The tcpdump shows that VIPA LTM sent a RST command to server(default pool member).

 

Any help would be greatly apprreciated.

 

6 Replies

  • gbbaus_104974's avatar
    gbbaus_104974
    Historic F5 Account

    I would guess that the SSL disable is happening too late.

     

    I would try the third example is this post https://devcentral.f5.com/wiki/iRules.ssl__disable.ashx

     

    From the post .... Note: Disabling SSL on the serverside only applies before serverside connection has been established (SERVER_CONNECTED) or when the clientside of the connection is in a detached state (e.g., oneconnect, LB::detach).

     

    • Ravi9_136822's avatar
      Ravi9_136822
      Icon for Nimbostratus rankNimbostratus
      Thank you, will try the 3rd option and post the out come here
    • Ravi9_136822's avatar
      Ravi9_136822
      Icon for Nimbostratus rankNimbostratus
      No luck. The first call to Intial page load on VIPA itself failed with error internet connection reset error
  • Here is the solution, we added snat in default path as well. Snat to local ip of load balancer, that resolved the issue.