CirrusInquiry regarding connection delay after IP change on customer's web server
hello. My name is Muntae Kim.
A customer inquired about delays occurring after changing the IP of the web server. We tried the previously resolved method, but it was ineffective, so we are writing a post and asking for your confirmation.
Product Name: BIG-IP i15800
Module name used: DDoS
Version information: BIG-IP 16.1.4.1 Build 0.50.5 Engineering Hotfix
HW information:
[Issues]
1. Additional inquiries regarding delays when connecting to the internal web server for the first time
- Recently, the [www.cafe24.com] server and the [ec.cafe24.com] server were merged with the same IP, so the existing Virtual Server rules were set to be used together.
- The structure used before is the same, but only the IP has changed.
- Problem solved by changing to Generate After Access on October 5, 2021
- Security ›› Bot Defense: This was resolved by changing www-cafe24-bot profile -> Browsers -> Device ID Mode to Generate [Before] Access → Generate [After] Access in Bot Defense Profiles, but this time, another cause occurred. Delays are expected to occur due to
- The following is the weblog of the [webserver] server in the LVS - webserver structure.
[www.cafe24.com] 121.171.250.49 - - [11/Jan/2024:15:13:47 +0900] "GET /TSPD/0853a021f8ab20008da153a52cba459997d15822279f2d1721f4f32c1ecb7be8b971b217ea8951b6?type=9
HTTP/1.1" 302 215 "https://www.cafe24.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "0.007"
[www.cafe24.com] 124.52.72.126 - - [11/Jan/2024:15:27:40 +0900] "GET /TSPD/?type=18 HTTP/1.1" 302 215 "https://www.cafe24.com/" "Mozilla/5.0 (Windows NT 10.0; Win6
4; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "0.003"
[inquiry]
1. Is the TSPD/xxx request part of the request that is assumed to be from F5 to the backend? If so, it is assumed that a 302 is displayed and there is a delay. Please check if the scenario I am expecting is correct.
2. Please check if there are any settings or options to control GET /TSPD/* related requests from F5 to the backend.
3. If you disable the currently used Bot Defense profile -> Browsers -> Device ID Mode to None in Generate After Access, please check how much the defense rate will drop by dividing it into DDoS defense and GET/DOS.
If you have additional information needed to resolve the issue, please reply.
thank you
