File upload fails if the file size is Greater than 65k when ssl policy is bound to the ADC LBVIP
book
Article ID: CTX221365
calendar_today
Updated On:
Description
- Can upload files of size only up to 64K
- Cannot upload files larger than 64K (upload stalls)
- SSL Policy with Action is bound to LB Vserver
Resolution
- Do Not Trigger Client Authentication through SSL Policy on Application Data (SSL policies are configured under Traffic Management > SSL > Policies and can have corresponding Actions)
- Perform Client Authentication during SSL handshake by enabling Client Authentication on SSL Profile or SSL parameter, not using a bound SSL Policy.
Example Solutions:
Using SSL Parameter
1. "set ssl vserver lb-vsvr -clientAuth ENABLED" (In GUI, this can be modified from "SSL Parameters" in the vserver settings)
OR
Using SSL Profile
2. If an SSL profile is being used, enable this on the SSL profile: "set ssl profile ssl_profile-clientAuth ENABLED" (In GUI, this is available under System>Profiles>SSL Profile)
Note there are 3 different SSL terms above, do not conflate them
SSL Policy - Typically has a corresponding SSL Action and uses an expression to select when to be triggered and is bound to an SSL vserver. (add ssl policy)
SSL Profile - This is a set of SSL parameters that can be bound to a Vserver and will always be applied on the front-end SSL connection. (add ssl profile)
SSL Parameter - This is an SSL parameter that can be set directly on a Vserver and will always be applied on the front-end SSL connection. (set ssl vserver)
Problem Cause
- Citrix ADC holds the ApplicationData in its memory if SSL Handshake is in ReNegotiation State .
- Due to the above scenario while uploading files , ADC per Connection Basis can hold only upto 65k Bytes , As a result if file size is Greater than 65k ADC will run out its TCP Window and advertises Zero window to the Client which results in File Upload Stall .
Was this article helpful?
thumb_up
Yes
thumb_down
No