Forum Discussion

itxali_313821's avatar
itxali_313821
Icon for Altocumulus rankAltocumulus
Apr 24, 2017
Solved

Server port not accessible from F5

Hi Gurus,

 

We have specific service running on server with port 3010 I can able to ping that server from F5 CLI, Telnet that server on port 22, 80 to check these service port accessible. After verifying these ports are accessible but unable to access this 3010 port. F5 and this server is connected at Layer 2 so there is not any blockage as I can access this service from all over our private network. Kindly suggest solution.

 

Big IP F5 1600, BIG-IP 10.2.3 Build, 112.0 Final

 

Thanks

 

application delivery
BIG-IP
  • itxali_313821's avatar
    itxali_313821
    Apr 27, 2017

    Thanks all for your help, actually issue was on Firewall there was policy which allows only ping, http & ssh traffic.

     

    My F5 management IP was 10.11.5.x/24 network, server was in 10.11.1.x/24 network so I was tracing on firewall using source IP F5 (10.11.5.x) destination server IP (10.11.1.x) I was getting no trace logs so I thought traffic was not blocked by firewall.

     

    After more troubleshooting, I enabled tcpdump on server in (10.11.1.x) network, so I came to know F5 was doing NAT when forwarding its traffic. Like 10.11.5.x network was NATTed to 10.11.3.x network, this was not allowed on firewall. After enabling this network for 3010 port on firewall it worked.

     

    Thanks all my concept was source and destination IP's never change util unless it is NATTED, still looking how F5 is NATTING its management IP from 10.11.5 to 10.11.3.

     

    Thanks.

     

9 Replies

Sort By
  • Samir_Jha_52506's avatar
    Samir_Jha_52506
    Icon for Noctilucent rankNoctilucent
    Apr 24, 2017

    Try to telnet VIP url with port 3010 from ur system to check if any network blockage. Enable SNAT auromat also. Paste the result.

     

  • Snl's avatar
    Snl
    Icon for Cirrostratus rankCirrostratus
    Apr 24, 2017

    do u have routedomain configured or try telnet to the vip and ensure under same vip pool u allow the node with correct port also you can do tcpdump and see whether you are getting the response from server or not , there are few scenario were you might have firewall in between F5 and server then you need to ensure you have allowed the self ip's over firewall for communication towards server.

     

    use below tcp dump - x.x.x.x is server ip

     

    tcpdump -ni 0.0:nnnp host x.x.x.x -s0 -w /var/tmp/traffic.pcap -vvv

     

  • Anuj_Chaudhary_'s avatar
    Anuj_Chaudhary_
    Icon for Nimbostratus rankNimbostratus
    Apr 24, 2017

    use below tcp dump - x.x.x.x is server ip tcpdump -ni 0.0:nnnp host x.x.x.x -s0 -w /var/tmp/traffic.pcap -vvv

     

  • itxali_313821's avatar
    itxali_313821
    Icon for Altocumulus rankAltocumulus
    Apr 24, 2017

    I can telnet VIP using port 3010 but webpage or requested service is not loading. When I telnet 3010, F5 shows current connection in statistics but webpage is not loading. http://10.11.3.14:3010/api Here is the URL on which service is running it is the VIP I can telnet this

     

  • dragonflymr's avatar
    dragonflymr
    Icon for Cirrostratus rankCirrostratus
    Apr 24, 2017

    Hi,

     

    Am I right that you are trying to connect to service from F5 (using cli)? If so how are you testing if port 3010 is not responding? What service is running under this port - http?

     

    Can you connect to this port from another device than BIG-IP?

     

    Or maybe you can't connect to Virtual Server configured on BIG-IP?

     

    Piotr

     

  • Snl's avatar
    Snl
    Icon for Cirrostratus rankCirrostratus
    Apr 24, 2017

    try removing the http profile and keep it none in the VS and do the telnet test again

     

    i have faced similar issue

     

  • Nicholas_P__308's avatar
    Nicholas_P__308
    Icon for Cirrus rankCirrus
    Apr 24, 2017

    Ensure the server is listening on port 3010. Also ensure automap is set or correct SNAT pool if you are going from the BIGIP F5, to the front-end of the F5, and back through. This would be the case if you are trying to telnet to the VIP. Automap and firewall verification shouldn't take long. If that does not resolve the issues, a tcpdump should fix it right up.

     

  • itxali_313821's avatar
    itxali_313821
    Icon for Altocumulus rankAltocumulus
    Apr 27, 2017

    Thanks all for your help, actually issue was on Firewall there was policy which allows only ping, http & ssh traffic.

     

    My F5 management IP was 10.11.5.x/24 network, server was in 10.11.1.x/24 network so I was tracing on firewall using source IP F5 (10.11.5.x) destination server IP (10.11.1.x) I was getting no trace logs so I thought traffic was not blocked by firewall.

     

    After more troubleshooting, I enabled tcpdump on server in (10.11.1.x) network, so I came to know F5 was doing NAT when forwarding its traffic. Like 10.11.5.x network was NATTed to 10.11.3.x network, this was not allowed on firewall. After enabling this network for 3010 port on firewall it worked.

     

    Thanks all my concept was source and destination IP's never change util unless it is NATTED, still looking how F5 is NATTING its management IP from 10.11.5 to 10.11.3.

     

    Thanks.

     

    • dragonflymr's avatar
      dragonflymr
      Icon for Cirrostratus rankCirrostratus
      Apr 27, 2017

      Hi,

       

      Management IP will be source of the traffic for dst IP in subnet not directly attached only if it has default gateway configured and if there is no SelfIP in dst subnet or if there is no route set in Networking section of the GUI for this subnet.

       

      In any other case proper VLAN SelfIP will be used.

       

      So there is chance that one of Self IP was used, probably because of route configured or because default gateway is configured to point to IP reachable via SelfIP in 10.11.3.0/24 subnet.

       

      Piotr

       

Related Content