Forum Discussion

chester_16314's avatar
chester_16314
Icon for Nimbostratus rankNimbostratus
Mar 05, 2013

Vendor mobile handler seems to conflict with BigIP

I'm going to try posting this here as the vendor is really not "ready" for this kind fo issue.

 

I have a third-party vendor software product that is installed on Windows and is running under IIS 7 on w2k8 r2. The configuration is really pretty simple as right now I have just one webserver and the application is installed under a virtual directory and listening on port 80.

 

On the BigIP, I have a pool defined for the server pointing to port 80. I have a virtual server defined for 80 that includes just a redirect iRule to 443. I have a virtual server on 443 that references the pool.

 

Everything works great except in one instance. The app has a handler built-in (there's no config) that senses a mobile device and sends the user to a virtual directory under the apps main virtual directory for mobile. This initial redirect works fine, but you can't get logged in.

 

If I:

 

  • Go directly to the windows server and connect (port 80) it works fine and you can log in.
  • If I remove the SSL redirect and try just straight port 80 through the BigIP it does NOT work.
  • And , again, trying through port 443 it also does not work.

Any ideas why BigIP would disrupt this and what I could try? This is a pretty vanilla setup on BigIP and on Windows.

 

 

 

config
design

3 Replies

Sort By
  • chester_16314's avatar
    chester_16314
    Icon for Nimbostratus rankNimbostratus
    Mar 08, 2013

    The software actually returns a "invalid login" as if you'd typed your password wrongly. It would appear that something is happening when going through F5 or with the fact that URL is different in the browser than what the webserver actually understands. Makes me think there is some sort of failed redirect going on or something.

     

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Mar 08, 2013
    how many servers do you have in the pool? if it is more than one, can you try to use only one and see if you still get invalid login message?

     

     

    for troubleshooting, i think tcpdump may be helpful. you may use http (remove ssl redirection) instead of https, so we do not have to decrypt packet to see packet content.

     

    tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap host x.x.x.x or host y.y.y.y

     

    x.x.x.x is virtual server ip

     

    y.y.y.y is pool member ip