We are using a CSS11503 without SSL module and S/W-Version 7.20 Build 104.
We define the following content rule:
content citrix-csg.oekb.at_https
add service citrix-csg.oekb.at_https_1
add service citrix-csg.oekb.at_https_2
vip address 143.245.6.101
protocol tcp
port 443
balance srcip
application ssl
active
We see that SSL sessions from a client to the vip address 143.245.6.101 are interrupted after a while (some after 10 minutes, others later).
A network sniffer trace, where the sniffer is located at the CSS UPLINK near the firewall , tells us:
- while the SSL session is up, there is a regular SSL network flow from the CSS VIP address to the client.
- in cases where the session is interrupted, we only see some packets directly sent by the server behind the CSS VIP address to the client!!??
It seems that the CSS box stops after a while (e.g. 10 minutes) to switch the packets due to the content rule. Instead of this the packets are routed as if there would not be any content rule.
Do you have any idea, what we can do?
Thank you for your help
Franz
