I have a F5 LTM VE in a HA Pair running on VMware 5.1 and the LTM is ver 11.2.1. Basically we have multiple Virtual Servers (URL's) setup and we are ONLY having issues with our Test URLs that we have setup. This has been going on for a few months now. When users are logged into the test URL's they will randomly get a page cannot be displayed error... sometimes hitting the back button will get them back to their page and refreshing will bump them back to the login screen. I don't see anything in logging showing the pools going up and down so I don't think that is the issue. This does not affect our product Virtual Servers and I have gone through the configurations a half dozen times and cannot find any differences. Our website admin isn't seeing anything in IIS logs that would point to a problem.
I have run the following packet capture on the F5 LTM where 10.30.1.75 is an internal user who experienced an "Page Cannot Be Dispalyed" message in IE around 11:54am. The packet capture I ran was:
tcpdump -ni 0.0:nnn -s0 '(host 10.30.1.75 and host 10.10.1.201)' or '(host 10.10.1.6 and (host 10.10.1.162 or host 10.10.1.163 or host 10.10.1.164 or host 10.10.1.165 or host 10.10.1.166 or host 10.10.1.160))' -w /var/tmp/TestDisconnectTroubleshooting.cap
A screen shot of an "interesting" section of the packet capture is attached. I'm concerned why I see the group of red "https [RST, AC]" packets and what that could mean regarding our issue.
Any insight or troubleshooting suggestions would be greatly appreciated.
Thank you!