Forum Discussion

eric_haupt1's avatar
eric_haupt1
Icon for Nimbostratus rankNimbostratus
Dec 18, 2018

OCSP outbound LB through F5 VS

I'm trying to solve a problem of ocsp reachability. My primary OCSP service is upstream through network transport outside of my control. We have replicated responders closerto the F5's location. I have a list of servers that have replicated the OCSP functionality. I'd like to use these servers in a pool using priority group activation for node selection: The closest resolver server being preferred, then our backup site, then the FQDN node associated with the ocsp service itself as a last resort. I can hit each responder using a host file edit with associated FQDN in the OCSP Auth config object - so I know the responders are working and reachable. I need to have the query hit an F5 VS for LB to my pool; and this is where things are breaking. I can't seem to get an OCSP query through a standard VS. I'm missing something...Any suggestions?

 

APM
security

4 Replies

Sort By
  • Rico_368208's avatar
    Rico_368208
    Icon for Nimbostratus rankNimbostratus
    Dec 18, 2018

    Eric,

     

    It is a bit hard to determine the exact issue just from you statement alone, but here are a few troubleshooting steps I would take.

     

    I'd suggest you run a tcpdump to ensure that the traffic is reaching the virtual server and that it is being sent out to its pool members. If you don't see any incoming traffic when you run the OCSP query, you know that there is some issue with network connectivity. If you see traffic hitting the virtual server and not being sent to the pool members, then that would seem to suggest that there is a connection issue between the client and the virtual server. If the query seems to pass through the virtual server and out to the pool members without an issue, I'd suggest checking your SNAT settings on the virtual server. Without the SNAT setting set to Automap (or SNAT pool if you have one configured), the response would not be routed properly back through the F5.

     

    If you can provide any more details, such as the results of tcpdump or where the query seems to be dropped, I'd be able to give more accurate and useful advice.

     

    Hope this helps.

     

    • eric_haupt1's avatar
      eric_haupt1
      Icon for Nimbostratus rankNimbostratus
      Dec 18, 2018

      Ahhh... I found it. It's trying to use an egress point when LB'd that is not permitted through our firewall. I need to add another float IP for my second traffic group.

       

  • Rico's avatar
    Rico
    Icon for Cirrus rankCirrus
    Dec 18, 2018

    Eric,

     

    It is a bit hard to determine the exact issue just from you statement alone, but here are a few troubleshooting steps I would take.

     

    I'd suggest you run a tcpdump to ensure that the traffic is reaching the virtual server and that it is being sent out to its pool members. If you don't see any incoming traffic when you run the OCSP query, you know that there is some issue with network connectivity. If you see traffic hitting the virtual server and not being sent to the pool members, then that would seem to suggest that there is a connection issue between the client and the virtual server. If the query seems to pass through the virtual server and out to the pool members without an issue, I'd suggest checking your SNAT settings on the virtual server. Without the SNAT setting set to Automap (or SNAT pool if you have one configured), the response would not be routed properly back through the F5.

     

    If you can provide any more details, such as the results of tcpdump or where the query seems to be dropped, I'd be able to give more accurate and useful advice.

     

    Hope this helps.