Forum Discussion

Ganesh_Garg's avatar
Ganesh_Garg
Icon for Nimbostratus rankNimbostratus
Jun 23, 2015

SSLoffload not working

I am trying to setup SSL-Offload for a application hosted on LTM.

 

Below is the configuration: -

 

  1. Imported SSL certificate.
  2. Created SSL Client profile with Imported SSL cert.
  3. HTTPS virtual server with SSL client cert.
  4. Associated Pool with port 8001

The error I am getting is that traffic is not reaching to the backend servers. In Wireshark we are getting SYN->SYN-ACK->ACK->PSH ACK->ACK between CLient and VIP only. no traffic on backend servers.

 

Any suggestions?

 

application delivery
LTM
TMOS
TMSH

8 Replies

Sort By
  • Samir_Jha_52506's avatar
    Samir_Jha_52506
    Icon for Noctilucent rankNoctilucent
    Jun 23, 2015

    Please check below thing.

     

    1. Check if backend server is lessening on port 8001{Telnet } from LB
    2. Enable SNAT Auto map to VIP.

    If still problem, paste VS, Pool & telnet output.

     

  • Ganesh_Garg's avatar
    Ganesh_Garg
    Icon for Nimbostratus rankNimbostratus
    Jun 23, 2015

    Yes, Servers are listening on port 8001, and SNAT is set to Automap also.

     

    -bash-3.00 telnet 100.96.52.201 8001 Trying 100.96.52.201... Connected to 100.96.52.201. Escape character is '^]'.

     

  • Ganesh_Garg's avatar
    Ganesh_Garg
    Icon for Nimbostratus rankNimbostratus
    Jun 23, 2015

    There is no server side traffic. connection terminates at client side only. after successful handshake push ack from client. and then fin ack.

     

    • TechT's avatar
      TechT
      Icon for Nimbostratus rankNimbostratus
      Jun 23, 2015
      can you try to configure a VS with port 80 and see if it forwards the traffic to backend server ? (just want to make sure there is no issues with VIP/pool config)
  • Ganesh_Garg's avatar
    Ganesh_Garg
    Icon for Nimbostratus rankNimbostratus
    Jun 23, 2015

    I have already configured a VIP with port 8001 and that is working as expected. issue is only with SSL offloading.

     

    • TechT's avatar
      TechT
      Icon for Nimbostratus rankNimbostratus
      Jun 23, 2015
      Try to do the things below, if possible please paste the output here 1) Check what is the response you are getting while hitting the https VIP url : https://www.sslshopper.com/ssl-checker.html (to check if the profile is configured properly with certs and key) 2) do a tcpdump like below for VIP and server when you hit the url - tcpdump -nni 0.0 host - tcpdump -nni 0.0 "host 100.96.52.201 and port 8001"
  • Ganesh_Garg's avatar
    Ganesh_Garg
    Icon for Nimbostratus rankNimbostratus
    Jun 29, 2015

    That issue is resolved, issue was actually the servers we have configured behind LB were weblogic servers. So I had to enable SSL-proxy=true in HTTP header to resolve the issue.