Feb 7 22:30:27 sslo1.f5labs.com info tmm2[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:12659183: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:36196 -> 142.251.12.95:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 L7 https (content-autofill.googleapis.com) decryption-status: decrypted duration: 87 msec service-path: ssloSC_all_services client-bytes-in: 1624 client-bytes-out: 4317 server-bytes-in: 6065 server-bytes-out: 1479 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'NA' policy-rule: 'All Traffic' url-category: /Common/Web_Infrastructure ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:30:27 sslo1.f5labs.com info tmm3[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:5601b3cd: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:36200 -> 142.251.12.95:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 L7 https (content-autofill.googleapis.com) decryption-status: decrypted duration: 76 msec service-path: ssloSC_all_services client-bytes-in: 1557 client-bytes-out: 1706 server-bytes-in: 5858 server-bytes-out: 1487 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'NA' policy-rule: 'All Traffic' url-category: /Common/Web_Infrastructure ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:30:31 sslo1.f5labs.com info tmm2[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:34954e2a: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:60772 -> 104.17.25.14:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 L7 unknown (cdnjs.cloudflare.com) decryption-status: decrypted duration: 5001 msec service-path: NA client-bytes-in: 963 client-bytes-out: 2781 server-bytes-in: 2844 server-bytes-out: 610 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'cl side error' policy-rule: 'L7 Protocol Lookup' url-category: /Common/Content_Delivery_Networks ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: |access2 ctx:0x400145326440 { Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | state:Finish [done], Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | pstate:Failing, nevent:FINISHED, external:1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | deferred [0/0]: 0 {} Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | tracker { Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | { Start:1, p:(None, External), n:(Evaluate, STARTED) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | { Evaluate:7, p:(Start, STARTED), n:(Failing, ERROR) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | { Failing:2, p:(Evaluate, ERROR), n:(Finish, FINISHED) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | { Finish:1, p:(Failing, FINISHED), n:(None, External) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | node: 0x400145326400 Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | axs2_main_ctx: 0x4001453264e0 { Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | apx { Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | current agent:L7 Protocol Lookup Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | agent execution status:Need more data to start policy Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | current hook:CLIENTSSL_SERVER_CERT Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | result:4 Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow-variables { Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.agent_category_lookup.type=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.agent_license.type=3, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.client.ip.address=10.1.10.50, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.client.port=60772, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.result.categories=| 150 |, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.failure=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.result.hostname=cdnjs.cloudflare.com, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.result.numcategories=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.result.numcustomcategories=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.result.primarycategory=150, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.result.url=https://cdnjs.cloudflare.com/, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.session.id=64edbb010a010a326811190e34954e2a, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.ssl.bypass_default=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.server.ip.address=104.17.25.14, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.server.port=443, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.session_check.session_found=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.ssl_check.ssl_found=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.ssl.client_cipher_name=ECDHE-RSA-AES128-GCM-SHA256, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.ssl.client_cipher_version=TLSv1.2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.ssl.server_cipher_name=ECDHE-ECDSA-AES128-GCM-SHA256, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.ssl.server_cipher_version=TLSv1.2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | held[0/4]: 0x400144fb1428 {} Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: |} Feb 7 22:30:31 sslo1.f5labs.com info tmm2[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:74c4d8d8: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:41476 -> 142.251.175.95:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 L7 unknown (fonts.googleapis.com) decryption-status: decrypted duration: 5001 msec service-path: NA client-bytes-in: 963 client-bytes-out: 3022 server-bytes-in: 4888 server-bytes-out: 610 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'cl side error' policy-rule: 'L7 Protocol Lookup' url-category: /Common/Web_Infrastructure ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: |access2 ctx:0x400145327840 { Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | state:Finish [done], Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | pstate:Failing, nevent:FINISHED, external:1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | deferred [0/0]: 0 {} Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | tracker { Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | { Start:1, p:(None, External), n:(Evaluate, STARTED) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | { Evaluate:7, p:(Start, STARTED), n:(Failing, ERROR) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | { Failing:2, p:(Evaluate, ERROR), n:(Finish, FINISHED) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | { Finish:1, p:(Failing, FINISHED), n:(None, External) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | node: 0x400145327800 Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | axs2_main_ctx: 0x4001453278e0 { Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | apx { Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | current agent:L7 Protocol Lookup Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | agent execution status:Need more data to start policy Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | current hook:CLIENTSSL_SERVER_CERT Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | result:4 Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow-variables { Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.agent_category_lookup.type=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.agent_license.type=3, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.client.ip.address=10.1.10.50, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.client.port=41476, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.result.categories=| 147 |, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.failure=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.result.hostname=fonts.googleapis.com, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.result.numcategories=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.result.numcustomcategories=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.result.primarycategory=147, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.category_lookup.result.url=https://fonts.googleapis.com/, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.session.id=04a2bb010a010a328efbaf5f74c4d8d8, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.ssl.bypass_default=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.server.ip.address=142.251.175.95, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.server.port=443, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.session_check.session_found=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.ssl_check.ssl_found=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.ssl.client_cipher_name=ECDHE-RSA-AES128-GCM-SHA256, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.ssl.client_cipher_version=TLSv1.2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.ssl.server_cipher_name=ECDHE-ECDSA-AES128-GCM-SHA256, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | perflow.ssl.server_cipher_version=TLSv1.2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | held[0/4]: 0x400144011428 {} Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm2[27190]: 01870014:5: |} Feb 7 22:30:31 sslo1.f5labs.com info tmm3[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:74a015f5: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:40536 -> 172.64.207.38:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 L7 unknown (use.fontawesome.com) decryption-status: decrypted duration: 5001 msec service-path: NA client-bytes-in: 963 client-bytes-out: 2729 server-bytes-in: 2798 server-bytes-out: 609 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'cl side error' policy-rule: 'L7 Protocol Lookup' url-category: /Common/Information_Technology ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: |access2 ctx:0x4001e282bf40 { Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | state:Finish [done], Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | pstate:Failing, nevent:FINISHED, external:1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | deferred [0/0]: 0 {} Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | tracker { Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | { Start:1, p:(None, External), n:(Evaluate, STARTED) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | { Evaluate:7, p:(Start, STARTED), n:(Failing, ERROR) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | { Failing:2, p:(Evaluate, ERROR), n:(Finish, FINISHED) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | { Finish:1, p:(Failing, FINISHED), n:(None, External) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | node: 0x4001e282bf00 Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | axs2_main_ctx: 0x4001e282bfe0 { Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | apx { Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | current agent:L7 Protocol Lookup Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | agent execution status:Need more data to start policy Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | current hook:CLIENTSSL_SERVER_CERT Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | result:4 Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow-variables { Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.agent_category_lookup.type=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.agent_license.type=3, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.client.ip.address=10.1.10.50, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.client.port=40536, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.result.categories=| 9 | 199 |, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.failure=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.result.hostname=use.fontawesome.com, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.result.numcategories=2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.result.numcustomcategories=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.result.primarycategory=9, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.result.url=https://use.fontawesome.com/, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.session.id=589ebb010a010a32ac40cf2674a015f5, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.ssl.bypass_default=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.server.ip.address=172.64.207.38, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.server.port=443, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.session_check.session_found=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.ssl_check.ssl_found=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.ssl.client_cipher_name=ECDHE-RSA-AES128-GCM-SHA256, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.ssl.client_cipher_version=TLSv1.2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.ssl.server_cipher_name=ECDHE-ECDSA-AES128-GCM-SHA256, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.ssl.server_cipher_version=TLSv1.2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | held[0/4]: 0x4001e18c7f68 {} Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: |} Feb 7 22:30:31 sslo1.f5labs.com info tmm[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:1267c10a: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:40668 -> 142.251.10.94:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 L7 unknown (fonts.gstatic.com) decryption-status: decrypted duration: 5001 msec service-path: NA client-bytes-in: 963 client-bytes-out: 2659 server-bytes-in: 4524 server-bytes-out: 607 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'cl side error' policy-rule: 'L7 Protocol Lookup' url-category: /Common/Search_Engines_and_Portals ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: |access2 ctx:0x400010b79740 { Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | state:Finish [done], Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | pstate:Failing, nevent:FINISHED, external:1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | deferred [0/0]: 0 {} Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | tracker { Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | { Start:1, p:(None, External), n:(Evaluate, STARTED) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | { Evaluate:7, p:(Start, STARTED), n:(Failing, ERROR) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | { Failing:2, p:(Evaluate, ERROR), n:(Finish, FINISHED) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | { Finish:1, p:(Failing, FINISHED), n:(None, External) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | node: 0x400010b79700 Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | axs2_main_ctx: 0x400010b797e0 { Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | apx { Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | current agent:L7 Protocol Lookup Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | agent execution status:Need more data to start policy Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | current hook:CLIENTSSL_SERVER_CERT Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | result:4 Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow-variables { Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.agent_category_lookup.type=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.agent_license.type=3, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.client.ip.address=10.1.10.50, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.client.port=40668, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.category_lookup.result.categories=| 76 |, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.category_lookup.failure=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.category_lookup.result.hostname=fonts.gstatic.com, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.category_lookup.result.numcategories=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.category_lookup.result.numcustomcategories=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.category_lookup.result.primarycategory=76, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.category_lookup.result.url=https://fonts.gstatic.com/, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.session.id=dc9ebb010a010a328efb0a5e1267c10a, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.ssl.bypass_default=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.server.ip.address=142.251.10.94, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.server.port=443, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.session_check.session_found=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.ssl_check.ssl_found=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.ssl.client_cipher_name=ECDHE-RSA-AES128-GCM-SHA256, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.ssl.client_cipher_version=TLSv1.2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.ssl.server_cipher_name=ECDHE-ECDSA-AES128-GCM-SHA256, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | perflow.ssl.server_cipher_version=TLSv1.2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | held[0/4]: 0x400010026488 {} Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm[27190]: 01870014:5: |} Feb 7 22:30:31 sslo1.f5labs.com info tmm1[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:de29dd70: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:40672 -> 142.251.10.94:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 L7 unknown (fonts.gstatic.com) decryption-status: decrypted duration: 5000 msec service-path: NA client-bytes-in: 963 client-bytes-out: 2659 server-bytes-in: 4526 server-bytes-out: 607 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'cl side error' policy-rule: 'L7 Protocol Lookup' url-category: /Common/Search_Engines_and_Portals ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: |access2 ctx:0x4000a742bf00 { Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | state:Finish [done], Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | pstate:Failing, nevent:FINISHED, external:1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | deferred [0/0]: 0 {} Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | tracker { Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | { Start:1, p:(None, External), n:(Evaluate, STARTED) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | { Evaluate:7, p:(Start, STARTED), n:(Failing, ERROR) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | { Failing:2, p:(Evaluate, ERROR), n:(Finish, FINISHED) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | { Finish:1, p:(Failing, FINISHED), n:(None, External) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | node: 0x4000a742bec0 Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | axs2_main_ctx: 0x4000a742bfa0 { Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | apx { Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | current agent:L7 Protocol Lookup Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | agent execution status:Need more data to start policy Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | current hook:CLIENTSSL_SERVER_CERT Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | result:4 Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow-variables { Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.agent_category_lookup.type=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.agent_license.type=3, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.client.ip.address=10.1.10.50, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.client.port=40672, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.category_lookup.result.categories=| 76 |, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.category_lookup.failure=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.category_lookup.result.hostname=fonts.gstatic.com, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.category_lookup.result.numcategories=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.category_lookup.result.numcustomcategories=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.category_lookup.result.primarycategory=76, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.category_lookup.result.url=https://fonts.gstatic.com/, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.session.id=e09ebb010a010a328efb0a5ede29dd70, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.ssl.bypass_default=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.server.ip.address=142.251.10.94, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.server.port=443, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.session_check.session_found=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.ssl_check.ssl_found=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.ssl.client_cipher_name=ECDHE-RSA-AES128-GCM-SHA256, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.ssl.client_cipher_version=TLSv1.2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.ssl.server_cipher_name=ECDHE-ECDSA-AES128-GCM-SHA256, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | perflow.ssl.server_cipher_version=TLSv1.2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | held[0/4]: 0x4000a6b60428 {} Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm1[27190]: 01870014:5: |} Feb 7 22:30:31 sslo1.f5labs.com info tmm3[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:5eca80ae: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:40546 -> 172.64.207.38:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 L7 unknown (use.fontawesome.com) decryption-status: decrypted duration: 5000 msec service-path: NA client-bytes-in: 963 client-bytes-out: 2729 server-bytes-in: 2798 server-bytes-out: 609 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'cl side error' policy-rule: 'L7 Protocol Lookup' url-category: /Common/Information_Technology ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: |access2 ctx:0x4001dee46e80 { Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | state:Finish [done], Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | pstate:Failing, nevent:FINISHED, external:1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | deferred [0/0]: 0 {} Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | tracker { Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | { Start:1, p:(None, External), n:(Evaluate, STARTED) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | { Evaluate:7, p:(Start, STARTED), n:(Failing, ERROR) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | { Failing:2, p:(Evaluate, ERROR), n:(Finish, FINISHED) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | { Finish:1, p:(Failing, FINISHED), n:(None, External) } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | node: 0x4001dee46e40 Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | axs2_main_ctx: 0x4001dee46f20 { Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | apx { Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | current agent:L7 Protocol Lookup Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | agent execution status:Need more data to start policy Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | current hook:CLIENTSSL_SERVER_CERT Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | result:4 Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow-variables { Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.agent_category_lookup.type=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.agent_license.type=3, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.client.ip.address=10.1.10.50, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.client.port=40546, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.result.categories=| 9 | 199 |, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.failure=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.result.hostname=use.fontawesome.com, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.result.numcategories=2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.result.numcustomcategories=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.result.primarycategory=9, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.category_lookup.result.url=https://use.fontawesome.com/, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.session.id=629ebb010a010a32ac40cf265eca80ae, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.ssl.bypass_default=0, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.server.ip.address=172.64.207.38, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.server.port=443, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.session_check.session_found=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.ssl_check.ssl_found=1, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.ssl.client_cipher_name=ECDHE-RSA-AES128-GCM-SHA256, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.ssl.client_cipher_version=TLSv1.2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.ssl.server_cipher_name=ECDHE-ECDSA-AES128-GCM-SHA256, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | perflow.ssl.server_cipher_version=TLSv1.2, Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | held[0/4]: 0x4001e2161ae8 {} Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: | } Feb 7 22:30:31 sslo1.f5labs.com notice tmm3[27190]: 01870014:5: |} Feb 7 22:30:47 sslo1.f5labs.com info tmm[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:6609a43f: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:43686 -> 20.122.63.128:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 L7 https (p.clarity.ms) decryption-status: decrypted duration: 24259 msec service-path: ssloSC_all_services client-bytes-in: 6002 client-bytes-out: 5856 server-bytes-in: 7854 server-bytes-out: 6973 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'NA' policy-rule: 'All Traffic' url-category: /Common/Information_Technology ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:31:30 sslo1.f5labs.com info tmm1[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:a195ea69: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:33658 -> 104.18.156.21:443 clientSSL: NA NA serverSSL: NA NA L7 https (cdn.who.int) decryption-status: not-decrypted duration: 64189 msec service-path: ssloSC_L2_services client-bytes-in: 1031 client-bytes-out: 1108 server-bytes-in: 1008 server-bytes-out: 979 client-tls-handshake: bypassed server-tls-handshake: NA reset-cause: 'NA' policy-rule: 'urlf_bypass' url-category: /Common/Health_and_Medicine ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:31:30 sslo1.f5labs.com info tmm3[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:ed8be0a8: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:36978 -> 13.107.213.59:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 L7 https (www.clarity.ms) decryption-status: decrypted duration: 63435 msec service-path: ssloSC_all_services client-bytes-in: 1586 client-bytes-out: 4064 server-bytes-in: 5841 server-bytes-out: 1306 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'TCP RST from remote system' policy-rule: 'All Traffic' url-category: /Common/Information_Technology ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:32:31 sslo1.f5labs.com info tmm2[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:dc58ef10: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:43716 -> 20.122.63.128:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 L7 https (p.clarity.ms) decryption-status: decrypted duration: 60986 msec service-path: ssloSC_all_services client-bytes-in: 1704 client-bytes-out: 1055 server-bytes-in: 6210 server-bytes-out: 1838 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'NA' policy-rule: 'All Traffic' url-category: /Common/Information_Technology ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:32:31 sslo1.f5labs.com info tmm3[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:45831dd7: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:57602 -> 142.251.175.97:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 L7 https (www.googletagmanager.com) decryption-status: decrypted duration: 125061 msec service-path: ssloSC_all_services client-bytes-in: 2886 client-bytes-out: 199327 server-bytes-in: 207783 server-bytes-out: 6831 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'NA' policy-rule: 'All Traffic' url-category: /Common/Information_Technology ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:32:31 sslo1.f5labs.com info tmm[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:9b8291a3: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:33676 -> 142.250.4.155:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 L7 https (stats.g.doubleclick.net) decryption-status: decrypted duration: 123954 msec service-path: ssloSC_all_services client-bytes-in: 1874 client-bytes-out: 4008 server-bytes-in: 5386 server-bytes-out: 1513 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'NA' policy-rule: 'All Traffic' url-category: /Common/Web_Analytics ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:33:32 sslo1.f5labs.com info tmm[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:06c7451e: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:43718 -> 20.122.63.128:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 L7 https (p.clarity.ms) decryption-status: decrypted duration: 60993 msec service-path: ssloSC_all_services client-bytes-in: 1708 client-bytes-out: 1055 server-bytes-in: 6158 server-bytes-out: 1790 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'NA' policy-rule: 'All Traffic' url-category: /Common/Information_Technology ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:33:32 sslo1.f5labs.com info tmm2[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:090105b9: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:45550 -> 64.233.170.138:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256 L7 https (www.google-analytics.com) decryption-status: decrypted duration: 186229 msec service-path: ssloSC_all_services client-bytes-in: 5882 client-bytes-out: 6791 server-bytes-in: 7261 server-bytes-out: 5795 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'NA' policy-rule: 'All Traffic' url-category: /Common/Web_Analytics ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:34:33 sslo1.f5labs.com info tmm3[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:70536d5a: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:43720 -> 20.122.63.128:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 L7 https (p.clarity.ms) decryption-status: decrypted duration: 60993 msec service-path: ssloSC_all_services client-bytes-in: 1707 client-bytes-out: 1055 server-bytes-in: 6158 server-bytes-out: 1789 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'NA' policy-rule: 'All Traffic' url-category: /Common/Information_Technology ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:35:28 sslo1.f5labs.com info tmm1[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:3aef239e: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:43722 -> 20.122.63.128:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 L7 https (p.clarity.ms) decryption-status: decrypted duration: 54994 msec service-path: ssloSC_all_services client-bytes-in: 1760 client-bytes-out: 1107 server-bytes-in: 6158 server-bytes-out: 1790 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'NA' policy-rule: 'All Traffic' url-category: /Common/Information_Technology ingress: /Common/client-vlan egress: /Common/outbound-vlan Feb 7 22:35:28 sslo1.f5labs.com info tmm1[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:3325642a: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:33648 -> 104.18.156.21:443 clientSSL: NA NA serverSSL: NA NA L7 https (www.who.int) decryption-status: not-decrypted duration: 302464 msec service-path: ssloSC_L2_services client-bytes-in: 3514 client-bytes-out: 19919 server-bytes-in: 2814 server-bytes-out: 601 client-tls-handshake: bypassed server-tls-handshake: completed reset-cause: 'connector abort by cs service' policy-rule: 'urlf_bypass' url-category: /Common/Health_and_Medicine ingress: /Common/client-vlan egress: NA Feb 7 22:40:36 sslo1.f5labs.com info tmm[27190]: 01c40000:6: /Common/sslo_demoL3.app/sslo_demoL3_accessProfile:Common:9493a2e9: /Common/sslo_demoL3.app/sslo_demoL3-in-t-4 Traffic summary - tcp 10.1.10.50:43724 -> 20.122.63.128:443 clientSSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 serverSSL: TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 L7 https (p.clarity.ms) decryption-status: decrypted duration: 307436 msec service-path: ssloSC_all_services client-bytes-in: 2048 client-bytes-out: 1315 server-bytes-in: 6106 server-bytes-out: 1818 client-tls-handshake: completed server-tls-handshake: completed reset-cause: 'connector abort by cs service' policy-rule: 'All Traffic' url-category: /Common/Information_Technology ingress: /Common/client-vlan egress: /Common/outbound-vlan