We have set up farm with 3 WFE's. Web apps are load balanced by hardware balancer with SSL. Assuming that our web site is https://www.foo.bar, we have our applications configured as follows:

  • HTTP binding on port 80 with host header www.foo.bar

Alternative access mappings:

Load balancer is configured to communicate with WFE on port 80. Everything looks to work as it should - users can access site via https, and can log in with ADFS without issues. But they can't upload any document, because connection is reset by server. Same thing on pages where there is at least one postback. And this happens only on FireFox. On IE, users can do what they like.

There is also zone for internal access, with Domain-signed certificate running on port 443. This is also mapped to address https://www.foo.bar, but only in internal DNS. Accessing site internally doesnt show same sympotms - everuthing looks to be working fine.

There must be some kind of misconfiguration, but I can't work it out. This is our first deployment with hardware LB and SSL.

  • I would take a Fiddler trace. Watch the interactions from both FireFox and IE and see where the communication is breaking down. You may need to go down to NetMon and look at the credential exchanges. Also are you using Kerberos in the deployment? If so you, be sure your DNS is configured with A records and not CNAME. – Jesus Shelby Jan 21 '13 at 19:47
  • Thx Jesus. I'll take a look with fiddler. We are not using Kerberos. – jjczopek Jan 21 '13 at 20:13
  • how have you configured Sessions affinity on your NLB? – Marius Constantinescu - MVP Jan 21 '13 at 20:17
  • I honestly don't know since we are not administering it. I sent message people responsible, so I let know. You think that there might be round-robin for each request? – jjczopek Jan 21 '13 at 20:33
  • When I turned on fiddler and decrypted SSL traffic, firefox started to work properly. But when I disabled SSL decryption, there is same problem. If this can make anything easier, we are using wildcard certificate from GoDaddy – jjczopek Jan 21 '13 at 21:12

We managed to resolve this issue. As it turned out, this is a common issue with firefox and SSL offloading on Cisco loadbalancers. Admin increased header buffers and now it works properly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.