F5 not sending traffic to Web pool

Question

Hello All,&nbsp;I am having issues with a new configured F5 big-IP that everything works fine as follows.&nbsp;traffic from the client is coming to the firewall which is then natted to the private network. (works)the Load balancer ( Virtual server) IP is accessible and request is sent to the virtual server.&nbsp;and from the big ip to the pool is not sent.connection between the F5 to the pool is fine and vice versa and pool and nodes are available (green).connection between web-server and F5 is through Https (443).&nbsp;configuration F5 as follows:&nbsp;F5&nbsp; Virtual IP : 192.168.1.41self IP:&nbsp; &nbsp;int 1 : 10.10.10.14self IP&nbsp; &nbsp;int 2 : 192.168.1.41&nbsp;web server pool :&nbsp; 10.10.10.X&nbsp; range with class c subnet.&nbsp;SSL is configured between the client to F5 as clientssl and between the server and F5 as serverssl.&nbsp;source address translation is automap.&nbsp;&nbsp;I am having trouble why it doesn't work and is trying to find out the problem.&nbsp;

paulius · Answer

If you can provide the associated configuration of the F5 it would help significantly in troubleshooting this issue. How have you verified that connections are not being sent out from the F5 to the pool members? If you could try running the following tcpdump it might point you to the issue.
&nbsp;
tcpdump -nni 0.0:nnp host &lt;virtual server IP&gt;
&nbsp;
The tcpdump should follow the SNAT that is occurring to see where the connection is not functioning properly.

ahadem · Answer

I captured the tcpdump packet and analyzed it, the request is coming from the client and three-way handshake is done between the client and the F5 but after nothing happens and when I look into the pool statistics nothing is there and it's all zero.&nbsp;&nbsp;have captured packets multiple times and checked packet by packet and the connection is RST at last.&nbsp;&nbsp;apm oauth db-instance /Common/oauthdb {&nbsp; &nbsp; description "Default OAuth DB."}apm policy customization-source /Common/modern { }apm policy customization-source /Common/standard { }apm report default-report {&nbsp; &nbsp; report-name sessionReports/sessionSummary&nbsp; &nbsp; user /Common/admin}ilx global-settings {&nbsp; &nbsp; debug-port-blacklist { 47019 54321 60000 }}ltm default-node-monitor {&nbsp; &nbsp; rule none}ltm node /Common/f5STGWEB01 {&nbsp; &nbsp; address 10.10.10.15&nbsp; &nbsp; monitor /Common/https_443}ltm node /Common/web1 {&nbsp; &nbsp; address 10.10.10.21&nbsp; &nbsp; monitor /Common/https_443}ltm pool /Common/webpool {&nbsp; &nbsp; members {&nbsp; &nbsp; &nbsp; &nbsp; /Common/f5STGWEB01:443 {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; address 10.10.10.15&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; /Common/web1:443 {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; address 10.10.10.21&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; monitor /Common/https and /Common/https_443}ltm snat-translation /Common/192.168.1.41 {&nbsp; &nbsp; address 192.168.1.41&nbsp; &nbsp; inherited-traffic-group true&nbsp; &nbsp; traffic-group /Common/traffic-group-1}ltm snatpool /Common/snatpool1 {&nbsp; &nbsp; members {&nbsp; &nbsp; &nbsp; &nbsp; /Common/192.168.1.41&nbsp; &nbsp; }}ltm virtual /Common/virtualserver1 {&nbsp; &nbsp; creation-time 2024-04-30:17:02:17&nbsp; &nbsp; description "virtual server is the load balancer server"&nbsp; &nbsp; destination /Common/192.168.1.41:443&nbsp; &nbsp; ip-protocol tcp&nbsp; &nbsp; last-modified-time 2024-05-08:17:01:47&nbsp; &nbsp; mask 255.255.255.255&nbsp; &nbsp; pool /Common/webpool&nbsp; &nbsp; profiles {&nbsp; &nbsp; &nbsp; &nbsp; /Common/F5SANCert {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; context clientside&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; /Common/serverssl {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; context serverside&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; /Common/tcp { }&nbsp; &nbsp; }&nbsp; &nbsp; serverssl-use-sni disabled&nbsp; &nbsp; source 0.0.0.0/0&nbsp; &nbsp; source-address-translation {&nbsp; &nbsp; &nbsp; &nbsp; type automap&nbsp; &nbsp; }&nbsp; &nbsp; translate-address enabled&nbsp; &nbsp; translate-port enabled}ltm virtual-address /Common/192.168.1.41 {&nbsp; &nbsp; address 192.168.1.41&nbsp; &nbsp; arp enabled&nbsp; &nbsp; icmp-echo enabled&nbsp; &nbsp; mask 255.255.255.255&nbsp; &nbsp; traffic-group /Common/traffic-group-local-only}ltm profile client-ssl /Common/F5SANCert {&nbsp; &nbsp; app-service none&nbsp; &nbsp; cert-key-chain {&nbsp; &nbsp; &nbsp; &nbsp; f5-F5-With-SAN_SANChainCert_0 {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cert /Common/f5-F5-With-SAN&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; chain /Common/SANChainCert&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; key /Common/f5-F5-With-SAN&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; defaults-from /Common/clientssl&nbsp; &nbsp; inherit-ca-certkeychain true&nbsp; &nbsp; inherit-certkeychain false&nbsp; &nbsp; options { dont-insert-empty-fragments no-tlsv1.3 no-tlsv1.1 no-sslv3 no-tlsv1 }}ltm profile client-ssl /Common/F5f5 {&nbsp; &nbsp; app-service none&nbsp; &nbsp; cert-key-chain {&nbsp; &nbsp; &nbsp; &nbsp; f5-F5-certificate_F5f5Chain_0 {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cert /Common/f5-F5-certificate&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; chain /Common/F5f5Chain&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; key /Common/f5-F5-certificate&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; defaults-from /Common/clientssl&nbsp; &nbsp; inherit-ca-certkeychain true&nbsp; &nbsp; inherit-certkeychain false}ltm profile client-ssl /Common/clientssl {&nbsp; &nbsp; alert-timeout indefinite&nbsp; &nbsp; allow-dynamic-record-sizing disabled&nbsp; &nbsp; allow-expired-crl disabled&nbsp; &nbsp; allow-non-ssl disabled&nbsp; &nbsp; app-service none&nbsp; &nbsp; authenticate once&nbsp; &nbsp; authenticate-depth 9&nbsp; &nbsp; bypass-on-client-cert-fail disabled&nbsp; &nbsp; bypass-on-handshake-alert disabled&nbsp; &nbsp; c3d-client-fallback-cert none&nbsp; &nbsp; c3d-drop-unknown-ocsp-status drop&nbsp; &nbsp; c3d-ocsp none&nbsp; &nbsp; ca-file none&nbsp; &nbsp; cache-size 262144&nbsp; &nbsp; cache-timeout 3600&nbsp; &nbsp; cert /Common/default.crt&nbsp; &nbsp; cert-extension-includes { basic-constraints subject-alternative-name }&nbsp; &nbsp; cert-key-chain {&nbsp; &nbsp; &nbsp; &nbsp; default {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cert /Common/default.crt&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; key /Common/default.key&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; cert-lifespan 30&nbsp; &nbsp; cert-lookup-by-ipaddr-port disabled&nbsp; &nbsp; chain none&nbsp; &nbsp; cipher-group none&nbsp; &nbsp; ciphers DEFAULT&nbsp; &nbsp; client-cert-ca none&nbsp; &nbsp; crl none&nbsp; &nbsp; crl-file none&nbsp; &nbsp; data-0rtt disabled&nbsp; &nbsp; generic-alert enabled&nbsp; &nbsp; handshake-timeout 10&nbsp; &nbsp; inherit-ca-certkeychain false&nbsp; &nbsp; inherit-certkeychain false&nbsp; &nbsp; key /Common/default.key&nbsp; &nbsp; max-active-handshakes indefinite&nbsp; &nbsp; max-aggregate-renegotiation-per-minute indefinite&nbsp; &nbsp; max-renegotiations-per-minute 5&nbsp; &nbsp; maximum-record-size 16384&nbsp; &nbsp; mod-ssl-methods disabled&nbsp; &nbsp; mode enabled&nbsp; &nbsp; notify-cert-status-to-virtual-server disabled&nbsp; &nbsp; ocsp-stapling disabled&nbsp; &nbsp; options { dont-insert-empty-fragments no-tlsv1.3 }&nbsp; &nbsp; passphrase none&nbsp; &nbsp; peer-cert-mode ignore&nbsp; &nbsp; peer-no-renegotiate-timeout 10&nbsp; &nbsp; proxy-ssl disabled&nbsp; &nbsp; proxy-ssl-passthrough disabled&nbsp; &nbsp; renegotiate-max-record-delay indefinite&nbsp; &nbsp; renegotiate-period indefinite&nbsp; &nbsp; renegotiate-size indefinite&nbsp; &nbsp; renegotiation enabled&nbsp; &nbsp; retain-certificate true&nbsp; &nbsp; secure-renegotiation require&nbsp; &nbsp; server-name none&nbsp; &nbsp; session-mirroring disabled&nbsp; &nbsp; session-ticket disabled&nbsp; &nbsp; session-ticket-timeout 0&nbsp; &nbsp; sni-default false&nbsp; &nbsp; sni-require false&nbsp; &nbsp; ssl-c3d disabled&nbsp; &nbsp; ssl-forward-proxy disabled&nbsp; &nbsp; ssl-forward-proxy-bypass disabled&nbsp; &nbsp; ssl-forward-proxy-verified-handshake disabled&nbsp; &nbsp; ssl-sign-hash any&nbsp; &nbsp; strict-resume disabled&nbsp; &nbsp; unclean-shutdown enabled}ltm profile client-ssl /Common/mynewcertificate {&nbsp; &nbsp; alert-timeout indefinite&nbsp; &nbsp; allow-dynamic-record-sizing disabled&nbsp; &nbsp; allow-non-ssl disabled&nbsp; &nbsp; app-service none&nbsp; &nbsp; cache-size 262144&nbsp; &nbsp; cache-timeout 3600&nbsp; &nbsp; cert-key-chain {&nbsp; &nbsp; &nbsp; &nbsp; MyCertificate_0 {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cert /Common/MyCertificate&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; key /Common/MyCertificate&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; cipher-group none&nbsp; &nbsp; ciphers DEFAULT&nbsp; &nbsp; data-0rtt disabled&nbsp; &nbsp; defaults-from /Common/clientssl&nbsp; &nbsp; generic-alert enabled&nbsp; &nbsp; handshake-timeout 10&nbsp; &nbsp; inherit-ca-certkeychain true&nbsp; &nbsp; inherit-certkeychain false&nbsp; &nbsp; max-active-handshakes indefinite&nbsp; &nbsp; max-aggregate-renegotiation-per-minute indefinite&nbsp; &nbsp; max-renegotiations-per-minute 5&nbsp; &nbsp; maximum-record-size 16384&nbsp; &nbsp; mod-ssl-methods disabled&nbsp; &nbsp; mode enabled&nbsp; &nbsp; notify-cert-status-to-virtual-server disabled&nbsp; &nbsp; ocsp-stapling disabled&nbsp; &nbsp; options { dont-insert-empty-fragments no-tlsv1.3 }&nbsp; &nbsp; peer-no-renegotiate-timeout 10&nbsp; &nbsp; proxy-ssl disabled&nbsp; &nbsp; proxy-ssl-passthrough disabled&nbsp; &nbsp; renegotiate-max-record-delay indefinite&nbsp; &nbsp; renegotiate-period indefinite&nbsp; &nbsp; renegotiate-size indefinite&nbsp; &nbsp; renegotiation enabled&nbsp; &nbsp; secure-renegotiation require&nbsp; &nbsp; server-name none&nbsp; &nbsp; session-mirroring disabled&nbsp; &nbsp; session-ticket disabled&nbsp; &nbsp; session-ticket-timeout 0&nbsp; &nbsp; sni-default false&nbsp; &nbsp; sni-require false&nbsp; &nbsp; ssl-sign-hash any&nbsp; &nbsp; strict-resume disabled&nbsp; &nbsp; unclean-shutdown enabled}ltm profile server-ssl /Common/do-not-remove-without-replacement {&nbsp; &nbsp; app-service none}net dns-resolver /Common/f5-aws-dns {&nbsp; &nbsp; forward-zones {&nbsp; &nbsp; &nbsp; &nbsp; amazonaws.com {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; nameservers {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 8.8.8.8:53 { }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; idservice.net {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; nameservers {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 8.8.8.8:53 { }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; shpapi.com {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; nameservers {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 8.8.8.8:53 { }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; route-domain /Common/0}net dns-resolver /Common/internaldns {&nbsp; &nbsp; forward-zones {&nbsp; &nbsp; &nbsp; &nbsp; dns {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; nameservers {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 192.168.1.11:53 { }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 192.168.1.12:53 { }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; route-domain /Common/0}net route /Common/default {&nbsp; &nbsp; gw 192.168.1.1&nbsp; &nbsp; mtu 1500&nbsp; &nbsp; network default}

zamroni777 · Answer

you can have decrypted tcpdump using this procedure which the result will be useful for analysis
https://clouddocs.f5.com/training/community/adc/html/class4/module1/lab10.html
https://my.f5.com/manage/s/article/K31793632

even with non decrypted tcpdump, wireshark can show tls session setup sequence.

at least in old version, health monitor uses management layer's network routing, which is different from what ltm traffic uses.
so, health monitor OK doesnt always mean ltm traffic can reach backend server.

f5_design_engineer · Answer

Can you please check the routes? As I can see, there's only one route default route for 192.168.x.x&nbsp; Can you also check? Do you need any more routes for 10 dot subnet&nbsp; for the internal interface&nbsp;
&nbsp;can you also check that you're using auto map in your VIP,&nbsp; &nbsp;you can try SNAT , so could you please try apply SNAT ?&nbsp;

ahadem · Answer

what route path normally ltm uses and how it makes the packet route decisions? if you could elaborate more on that.

Forum Discussion

F5 not sending traffic to Web pool

8 Replies

Recent Discussions

"Brighten Your Health: Vitamin Dee Me Gummies Now Available in South Africa"

Need help on CLI command to fetch < VIP Name + current connections >

Glycogen Control Australia Is Right For You See Here

APM combine check for ldap group plus IP ACL

Error in REST https call to get the Auth token v15.1.8

Related Content

Multiple ports in a Single Health Monitor and LTM policy to Send Traffic to a single pool

fellow traffic

LTM policy to route traffic to different pools

Traffic Policy vs iRule Pool Redirect

Block traffic