topic Re: Urgent Please.... Help on https issue in Application Networking

Urgent Please.... Help on https issue

hassan_oudeh — Thu, 31 Jan 2008 08:23:25 GMT

Hi,

I have CSS11501, i have problem during accessing the server with the VIP only when using https, ssl certificates has been installed in CSS. That is i tried with http only and it worked fine. but when use https im getting a session expired all the time

i checked also with IE and Mozilla and found out both are the same message always "Session Expired" but noticed with Mozilla always the behavoiur is much much better !!

there is no no load-balancing, and i was checking with bot set of servers PUSH/PULL and GOTBOFE (as attached file shows) and on both im getting the same problem !!

Please Can you advice !!!

Regards,

Hasan

Re: Urgent Please.... Help on https issue

Gilles Dufour — Thu, 31 Jan 2008 09:07:46 GMT

Hasan,

what do you mean by session expired ?

Are you able to see the page, but after a while, when you click on a link you get a session expired ?

There is 4 minutes idle timeout on the ssl-module.

Virtual TCP Inactivity TO: 240 Server TCP Inactivity TO: 240

After that, the connection is removed.

Not sure if that is the problem.

Maybe get us a sniffer trace showing the problem and explain what you see and do before getting the error.

Gilles.

Re: Urgent Please.... Help on https issue

hassan_oudeh — Fri, 01 Feb 2008 17:53:00 GMT

Gilles..

thanks for your response...

i found where the problem ...

there was some packests being sent from thr CSS to the server which exceed the m aximum segment size. and the firwall was blocking these traffice 🙂 from the loggin message from the ASA firewall i was seing exceed-mss

after 3 days of troublshooting finally we got it 🙂

anyways thanks

Re: Urgent Please.... Help on https issue

Oscar Cardiel — Wed, 25 Nov 2009 08:29:29 GMT

Hi Hassan,

I have just the same issue. How do you solved it?, did you change the MSS size in the ASA straightly or in CSS with he commands “flow tcp-mss ..” and “tcp-ip fragment enable”.

Thanks you,

Oscar

Re: Urgent Please.... Help on https issue

hassan_oudeh — Wed, 25 Nov 2009 08:34:14 GMT

Actually that was very long time.

I really forgot the commands and I don't have access to the device.

But try enable the logging on the ASA and see what is happining exaclty in your case.

Regards,

Re: Urgent Please.... Help on https issue

Oscar Cardiel — Wed, 25 Nov 2009 09:01:34 GMT

yep, that's a pity!, I will keep working with in it. Thanks a million!

Cheers,

Oscar