Forum Discussion

Icemanii_116694's avatar
Icemanii_116694
Icon for Nimbostratus rankNimbostratus
May 14, 2015
Solved

Unable to kill system connection using tmsh delete sys conn

I created a VS as below:

 

ltm virtual /Common/webserver_ISP2_http { destination /Common/71.1.1.3:80 ip-protocol tcp mask 255.255.255.255 persist { /Common/cookie { default yes } } pool /Common/WebPool2 profiles { /Common/http { } /Common/optimized-caching { } /Common/wan-optimized-compression { } } source 0.0.0.0/0 translate-address enabled translate-port disabled vlans { /Common/ISP2 } vlans-enabled }

 

I am seeing a lot of connections from my outgoing IP pinging to the public IP for this VS 71.1.1.3. Even after I disabled and deleted the VS I am still seeing a lot of connections being generated to this IP. I tried to kill the connections using the following:

 

tmsh delete sys conn cs-server-addr 71.1.1.3

 

when I am still seeing an increase in the connections when I use tmsh show sys conn cs-server-addr 71.1.1.3:

 

71.1.1.1:35980 71.1.1.3:80 71.1.1.1:58995 71.1.1.3:80 tcp 1 (tmm: 3) none 71.1.1.1:4972 71.1.1.3:80 71.1.1.1:40801 71.1.1.3:80 tcp 1 (tmm: 3) none Total records returned: 6686

 

I am unable to find any config related to the 71.1.1.3 VS after I deleted the VS. But I am still seeing connections. Any help will be much appreciated.

 

  • i think it will take a little bit time to kill all the connections.

     

    otherwise, if you want, you may try packet filter to reject connection to 71.1.1.3:80 or block it on upstream device.

     

4 Replies

  • i think it will take a little bit time to kill all the connections.

     

    otherwise, if you want, you may try packet filter to reject connection to 71.1.1.3:80 or block it on upstream device.

     

    • Icemanii_116694's avatar
      Icemanii_116694
      Icon for Nimbostratus rankNimbostratus
      Thanks for your help. I managed to isolate the connection to be generating from a pool of internal servers running some servers to the 71.1.1.3 IP. (This IP is a recycled IP) Once I created a FW policy to restrict off the servers to access the IP, all the connections dropped immediately.
  • i think it will take a little bit time to kill all the connections.

     

    otherwise, if you want, you may try packet filter to reject connection to 71.1.1.3:80 or block it on upstream device.

     

    • Icemanii_116694's avatar
      Icemanii_116694
      Icon for Nimbostratus rankNimbostratus
      Thanks for your help. I managed to isolate the connection to be generating from a pool of internal servers running some servers to the 71.1.1.3 IP. (This IP is a recycled IP) Once I created a FW policy to restrict off the servers to access the IP, all the connections dropped immediately.