Forum Discussion

getrajan1's avatar
getrajan1
Copper Contributor
Oct 28, 2024

App Connectivity issue

I have come across an issue being reported by one of the user stating that he is unable to connect to an application on port 5672 hosted behind azure internal load balancer. 

on my observation from Azure portal post login i see that Azure front end load balancer is marking the front end port as unresponsive/down for service 5672, while the back end port 2009 on azure internal load balancer is seen up on the back end pool virtual F5 .port mapping done properly on azure

 

Error as seen on Azure is “TCP probe out, unhealthy backend instances or unhealthy app listening on port”

 

However when I check on the Virtual F5 the backend server is responding on port 5672 normally, the health checks look ok, thereby the vip is marked as up. 

 

is this abnormal behaviour on the application side against 5672 service or something more to check on the azure side which is resulting to TCP probe out error.. pls suggest

load balancer

2 Replies

  • khatland's avatar
    khatland
    Copper Contributor
    Jul 14, 2025

    I see that this post is a bit old, but for those who run into the same issue I will add a response.
    I've worked with F5 VE in Azure quite a bit and have seen the issues mentioned.

     

    Unfortunately the setup is a bit tricky, but explained well by F5 on their docs.

    Firstly you should use the mgmt port as the health-probe port, so if that is 443 or 8443 use that as healthprobe for all LB rules. This has to do with how the health-probes function, just having a F5 VS with the port is not enough, so you should use the web-gui port. 

    Secondly the LB will strip/drop TCP-RST and TCP-FIN messages which causes a bit of session mismatches, along with the 4min timeout. So go ahead and set the timeout to at least 5minutes on the LB rules and switch ON the TCP Reset function to actually forward those.

    Further if you wish to have F5 VS on the same IP as the frontend-ip of the LB you need to switch on "Floating IP" on the LB rule. 
    Natively the LB will change (DNAT) the destination address on the packets to the actual instance IP of the backend instance it forwards traffic to. This of course does not work well with F5, so to fix that the "Floating IP" will retain the destination address, but still forward it to the F5, which allows you to set up a VS with the same IP as the LB front-end IP. Note that you do NOT need to set up an internal interface with the IP or VLAN with that IP, just the actual VS. And the VS will pick up the traffic even when it comes in on an interface with another IP. (Just like on-prem). 

     

    Hope this helps, please mark this as resolved if you think it helps, so that other users might find this as well!

    Br
    Kristoffer

Resources