Forum Discussion

Dicky_Moe_13167's avatar
Dicky_Moe_13167
Icon for Nimbostratus rankNimbostratus
Mar 26, 2015

TCP monitor vs TCP Half Open

Hi Guys!

 

Got a question for you ... I have a pool of Citrix Gateways, configured with the default TCP monitor. This is causing the gateways to log an error of this sort "SSL three way handshake error" every 5 seconds, apparently because the TCP monitor doesn't close the connection.

 

I changed the monitor in our dev environment to TCP Half Open, which, according to what I've read, sends a RESET after receiving the ACK/SYNC from the pool member, so the connection is closed properly.

 

My question is (before I put this in production) : Does the TCP monitor catch something that the Half OPen doesn't and which could interest me?

 

Thanks, Fabian

 

application delivery
deployment
design
LTM
management

2 Replies

Sort By
  • Brad_Parker's avatar
    Brad_Parker
    Icon for Cirrus rankCirrus
    Mar 26, 2015

    You are most likely getting the SSL failure because with a TCP monitor you complete a full three-way handshake. Since you are using a TCP monitor against an SSL interafce it then tries to initiate the SSL handshake and fails. TCP Half-Open doesn't complete the three-way handhsake since it sends a RST instead of an ACK, so it never attempts the SSL handshake. So, in short the TCP vs Half-open will only give you the knowledge that a full TCP handshake can occur vs it responding on the port.