Forum Discussion

Francisco_Verde's avatar
Francisco_Verde
Icon for Altostratus rankAltostratus
Feb 16, 2018

http profile breaks down my virtual server

Each time I'm applying an HTTP profile on my virtual server the site is not accessible. If I put "none" at the HTTP profile, the site is accessible.

 

The weirdest thing is I have the same service running behind a Barracuda WAF and it's working fine.

 

Moreover when I tcpdump from the 'internal' interface (server side), I don't see any traffic passing through when HTTP profile is applied.

 

If anyone have any idea ?

 

6 Replies

  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus

    Francisco,

     

    Are you able to share the virtual server configuration? Anonymised of course.

     

    I've seen this before when the VIP is listening on port 443 (HTTPS) but there is no clientssl profile, ie the bigip is not decrypting the traffic. In that scenario adding a http profile can break the application.

     

    Hope this helps,

     

    N

     

  • you can review the ltm log [tailf /var/log/ltm]and verify what is returned when you have the http profile.

     

    also, you can try to decrypt the packet capture so you see what is being exchanged.

     

    use the syntax: tcpdump -nni 0.0:nnnp -s0 host -w /var/tmp/vs_http_fail.pcap -vv

     

     

    use this to decrypt: K10209: Overview of packet tracing with the ssldump utility

     

    or use the irule - apply it first to vs before running the pcap. also, make sure your session is fresh - so start from scratch - fresh browser session: see https://devcentral.f5.com/questions/ssldump-and-internal-hsm

     

    when CLIENTSSL_HANDSHAKE {

     

    log local0. "RSA Session-ID:[SSL::sessionid] Master-Key:[SSL::sessionsecret]”

     

    }

    try until you get the decrypted data, then, analyse further

     

    good luck

     

  • Hi Nathan,

     

    Looks like you're right...I didn't see any GET request from the client...this is why wont see any traffic passing through my F5 whenever I apply my http profile.

     

    I guess I'll have limited option to protect my service behind.

     

    Thanks for the help, Francisco

     

  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus

    OK Francisco, thanks for the update. Glad we could help.