FTPS Loadbalancing

Question

Can we load balance ftps, i am using V11.5.1 , i have created one VS for port 21 and another wildcard(any) VIP. But the passive mode returning server ip. Please see error.&nbsp;Code
Command:    TYPE I
Response:   200 Type set to I.
Command:    PASV
Response:   227 Entering Passive Mode (192,168,68,206,231,188).
Command:    LIST
Response:   150 Opening BINARY mode data connection.
Error:  GnuTLS error -110: The TLS connection was non-properly terminated.
Status: Server did not properly shut down TLS connection
Error:  Transfer connection interrupted: ECONNABORTED - Connection aborted
Response:   550 The network connection was aborted by the local system. 
Error:  Failed to retrieve directory listing
Error:  GnuTLS error -110: The TLS connection was non-properly terminated.
Status: Server did not properly shut down TLS connection
Error:  Disconnected from server: ECONNABORTED - Connection aborted

iamczar_12961 · Answer

You cannot currently configure the BIG-IP LTM to terminate FTPS connections and offload SSL processing, but you can configure the BIG-IP LTM to load balance FTPS traffic using passthrough encryption.&nbsp;
SOL9347: Configuring passthrough FTPS load balancing
https://support.f5.com/kb/en-us/solutions/public/9000/300/sol9347.html&nbsp;

iamczar_12961 · Answer

You cannot currently configure the BIG-IP LTM to terminate FTPS connections and offload SSL processing, but you can configure the BIG-IP LTM to load balance FTPS traffic using passthrough encryption.&nbsp;
SOL9347: Configuring passthrough FTPS load balancing
https://support.f5.com/kb/en-us/solutions/public/9000/300/sol9347.html&nbsp;

mikegray_198028 · Answer

I followed the same document only but passive mode notworking&nbsp;

mikegray_198028 · Answer

Any idea &nbsp;

tysonn_247085 · Answer

hello mike,
this is tyson, i hope that the answer i gave to your previous query "unable to ping" was helpful.Either you could have disabled arp on that or enabled echo icmp. i lost my previous account so i created a fresh one with an extra one. Any ways let us come to the point ....
If configuring a masquerade address is not possible, you may be able to configure the server to use the IP address of the virtual server by binding the virtual server address to a network interface.
 so use:     ifconfig [nic]:0 [IP-Address] netmask [mask] up on the back-end  ftps server.i,e adding one more ip address to the nic of backend server. But ensure that this new ip would be the "vip ip ".&nbsp;

Forum Discussion

FTPS Loadbalancing

8 Replies

Recent Discussions

About custome Response Blocking Page

About IPI check ip list

Cookie Violation - Expired TimeStamp.

Disacard SSL::cert mode to ignore when default SSLClient profile is set to request or require

CGNAT with DS-lite and LSN

Related Content

FTP Session Logging

Loadbalancing issue

FTPS Offload via iRules

iRule Security 101 - #07 - FTP Proxy

BIG-IP / Virtual Server for UDP & TCP DNS Loadbalancing / extracting client IPs