Forum Discussion

Ken_B_50116's avatar
Ken_B_50116
Icon for Cirrostratus rankCirrostratus
Mar 25, 2015
Solved

Servers using LTM as its gateway can ping but can't connect on 443

I have a situation where a group of servers that use LTM as their gateway can successfully ping and tracert to servers in a totally different subnet, but are unable to connect on port 443.   Speci...
application delivery
design
LTM
  • Jason_40733's avatar
    Jason_40733
    Mar 25, 2015

    I keep thinking asymmetric routing... but your ports match up. a tcpdump on the F5 may give you more info where you could see all the MAC addresses.

     

Ken_B_50116's avatar
Ken_B_50116
Icon for Cirrostratus rankCirrostratus
Mar 25, 2015

I ran a tcpdump and got the following. The only thing that stands out to me is all of the incorrect checksums:

[root@F5-LTM:Active:Changes Pending] config  tcpdump -vvv -i 0.0:nn host 172.22.0.100
tcpdump: listening on 0.0:nn, link-type EN10MB (Ethernet), capture size 96 bytes
09:08:23.873055 IP (tos 0x0, ttl 128, id 17365, offset 0, flags [DF], proto: TCP (6), length: 48) 10.54.13.101.14196 > 172.22.0.100.https: S, cksum 0x0da9 (correct), 1382886100:1382886100(0) win 64240 
09:08:23.873085 IP (tos 0x0, ttl 127, id 17365, offset 0, flags [DF], proto: TCP (6), length: 48) 10.54.13.101.14196 > 172.22.0.100.https: S, cksum 0xc437 (incorrect (-> 0x0da9), 1382886100:1382886100(0) win 64240 
09:08:23.874461 IP (tos 0x0, ttl 124, id 16901, offset 0, flags [none], proto: TCP (6), length: 48) 172.22.0.100.https > 10.54.13.101.14196: S, cksum 0x6fbf (correct), 3001936618:3001936618(0) ack 1382886101 win 64240 
09:08:23.874482 IP (tos 0x0, ttl 123, id 16901, offset 0, flags [none], proto: TCP (6), length: 48) 172.22.0.100.46740 > 10.54.13.101.14196: S, cksum 0xc437 (incorrect (-> 0xbae5), 3001936618:3001936618(0) ack 1382886101 win 64240 
09:08:23.874607 IP (tos 0x0, ttl 128, id 17366, offset 0, flags [none], proto: TCP (6), length: 40) 10.54.13.101.14196 > 172.22.0.100.46740: R, cksum 0x033e (correct), 1382886101:1382886101(0) win 0
09:08:23.874614 IP (tos 0x0, ttl 127, id 17366, offset 0, flags [none], proto: TCP (6), length: 40) 10.54.13.101.14196 > 172.22.0.100.https: R, cksum 0xc42f (incorrect (-> 0xb817), 1382886101:1382886101(0) win 0
09:08:26.851901 IP (tos 0x0, ttl 128, id 17376, offset 0, flags [DF], proto: TCP (6), length: 48) 10.54.13.101.14196 > 172.22.0.100.https: S, cksum 0x0da9 (correct), 1382886100:1382886100(0) win 64240 
09:08:26.851911 IP (tos 0x0, ttl 127, id 17376, offset 0, flags [DF], proto: TCP (6), length: 48) 10.54.13.101.14196 > 172.22.0.100.https: S, cksum 0xc437 (incorrect (-> 0x0da9), 1382886100:1382886100(0) win 64240 
09:08:26.852979 IP (tos 0x0, ttl 124, id 16902, offset 0, flags [none], proto: TCP (6), length: 48) 172.22.0.100.https > 10.54.13.101.14196: S, cksum 0xc0eb (correct), 3002702258:3002702258(0) ack 1382886101 win 64240 
09:08:26.853039 IP (tos 0x0, ttl 123, id 16902, offset 0, flags [none], proto: TCP (6), length: 48) 172.22.0.100.34221 > 10.54.13.101.14196: S, cksum 0xc437 (incorrect (-> 0x3cf9), 3002702258:3002702258(0) ack 1382886101 win 64240 
09:08:26.853180 IP (tos 0x0, ttl 128, id 17377, offset 0, flags [none], proto: TCP (6), length: 40) 10.54.13.101.14196 > 172.22.0.100.34221: R, cksum 0x3425 (correct), 1382886101:1382886101(0) win 0
09:08:26.853186 IP (tos 0x0, ttl 127, id 17377, offset 0, flags [none], proto: TCP (6), length: 40) 10.54.13.101.14196 > 172.22.0.100.https: R, cksum 0xc42f (incorrect (-> 0xb817), 1382886101:1382886101(0) win 0