Forum Discussion

fluidbios_18790's avatar
fluidbios_18790
Icon for Altostratus rankAltostratus
Feb 06, 2019

New Wildcard Virtual Server isn't Working

We want to change the way our 80/443 traffic flows through our Transparent Proxy.

 

Current Setup (WCCP): Server -> Switch -> WSA (Transparent Proxy) -> Internet

 

Desired Setup (No WCCP): Server -> Switch -> LTM -> WSA (Transparent Proxy) -> Internet

 

I've been working with F5 Support to find a solution and they recommended I use a Performance (Layer 4) WildCard Virtual Server and LoadBalance the WSA device. According to the documentation my configuration should be passing my test traffic to the WSA but there's no indication that the Virtual Server is actually picking up the incoming traffic. tracert/TCPDump confirm the traffic is making it to the F5 device, does a couple TCP Retransmissions, then drops. Looking at traffic on the WSA I see no 0 traffic coming from my test server or the floating IP for the LTM (since I removed the test server from the WCCP config and sent it to the F5).

 

application delivery
BIG-IP
LTM

4 Replies

Sort By
  • fluidbios_18790's avatar
    fluidbios_18790
    Icon for Altostratus rankAltostratus
    Feb 06, 2019

    I have 2 Virtual Servers setup - 1 for port 80 and 1 for port 443.

     

    WSA_Forwarding (Destination 0.0.0.0 Port 80) WSA_FORWARDING 216.205.91.9:80

     

    WSA_Forwarding_443 (Destination 0.0.0.0 Port 443) WSA_FORWARDING_443 216.205.91.9:443

     

  • fluidbios_18790's avatar
    fluidbios_18790
    Icon for Altostratus rankAltostratus
    Feb 06, 2019

    Here's my test log:

     

    -Confirmed I can use 10.53.81.163 - Can access google.ca -Setup a new Access rule in the WCCP ACL to send it to the f5 -Tracert indicates that it's making it to the F5 -Tried standard profile. -Tried automap -Tried Persistence -Tried all :80 pool members -Setup a :443 pool -Tried setting up http/https profiles -TCPDump revealed the traffic is at least making it to the LTM -Stats indicate the VIPs haven't been used so the VIP is configured incorrectly. -Disabled the Secure VIP and Set the other VIP to All ports -I can ping the WSA (216.205.91.9) from the Qual LTM -Confirmed that both of these virtual devices are in the same VLANs, 216 and 2040. (Neither of them Private VLANs) -Reviewed the TCP handshake of a Performance Layer4 virtual server: According to the VIP/Pool stats no packets have been received for the duration of the testing We never get to "LTM sends SYN request to Node" in this flow so it looks like the VIP isn't intercepting this traffic for processing. https://support.f5.com/csp/article/K8082l4

     

    Familiarized myself with the basic overview of Wild Card Virtual Servers: https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-concepts-11-5-0/2.html

     

    They recommend the following: "We recommend that when you define transparent nodes that need to handle more than one type of service, such as a firewall or a router, you specify an actual port for the node and turn off port translation for the virtual server."

     

  • Stephane_Viau's avatar
    Stephane_Viau
    Icon for Nimbostratus rankNimbostratus
    Feb 06, 2019

    So if you look at the Virtual Server statistics, numbers are still showing 0? If so, perhaps your packets are dropped by another module like AFM. Is this a LTM box only? And how many other Virtual Servers do you have on the Big-IP? Could your requests end up in the wrong Virtual Server?

     

  • RaghavendraSY's avatar
    RaghavendraSY
    Icon for Altostratus rankAltostratus
    Feb 17, 2019

    Please try below configuration:

     

    Enable Fastl4 See SNAT configuration at the pool level too Try Applying virtual server (VLANS and Tunnels) at VLAN level instead of all VLAN's