Forum Discussion
Auto Last Hop and ARP state table
We are migrating from Cisco 6500 Catalysts to Nexus 9300, during our network migration I noticied issues with servers through the F5 LTM.
Before I moved the routing over to the Nexus I could ping and SSH to my Unix Boxes sitting behind the F5, after the move I could not ping the servers but I could SSH successfully. From other other routers and switches I could ping and SSH to these Servers successfully.
I ran some packet captures and noticed some unusual behaviour, my colleague could ping and SSH to the Servers from his PC successfully I could see the F5 replying to the Primary HSRP SVI on the new switch (NB: he wasn't pinging any Servers before my SVI/routing move!), whereas my ICMP requests the F5 was replying to the old Port channel switch to the other switch. This was happening for almost 4 and half hours! Then suddenly I could ping and SSH successfully to the Servers, this is without disabling Auto Last Hop. The default route on my LTM pair is the Primary HSRP SVI which is ideally where the traffic should go. I know ALH is enabled by default globally this will send return traffic back to the Source MAC Address where the connection was received from (other switch)!
But I have concerns why did it take 4hrs30mins to resolve? Shouldn't the F5 be updating it's ARP table?
And shouldn't most setups be disabling ALH in this scenario? What happens if the SVI is shutdown or that switch dies, you'd expect the F5 to see remove that MAC from it's stable table immediately but after my issue I have concerns as to why the F5 is not updating it's state table?
My ICMP echo requests were sent through Nexus new SVI's Echo Reply sent sent back to SRC MAC address on old non existent SVI's? why?
- portoalegre
Nimbostratus
Before change
- portoalegre
Nimbostratus
After change
- Hamish
Cirrocumulus
Auto Last Hop doesn't use the ARP table. Like you said, it uses the MAC address that the connections as opened for.
As long as the connection table entry is there, it'll continue to go back that way. I suspect the 4.5 hours was when the connection table entry was flushed.
- JG
Cumulonimbus
Have you seen the following:
K13876: Overview of the Auto Last Hop setting (11.x - 13.x)
K9487: BIG-IP support for neighboring VRRP/HSRP routers
?
We also had to battle with the compatibility issue with products of 3rd-party vendors years ago.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com