Dear everyone.

Please help me with this topology.

Network topology attached as below.

Routing:

Cache farm using Bluecoat Cache Devices.

Default route of caches is BigIP VLAN 2's ip address (233.x.x.129)

Default route of BigIP is Vlan 3 on Multilayer Switch (MS) (233.x.x.230)

Vlan 1 of MS connect to Subscribers network and Vlan 2 connect direct to Internet router.

Configurations:

BIG-IP LTM:

I created two Pools:

Go_in_pool: has 3 members are three Cache devices (233.x.x.130-132)

Go_out_pool: has only one member: VLAN3 MS (233.x.x.230)

And two Wildcard Virtual Server associate with 2 pools:

Go_in_server:

- Destinations: Network 0.0.0.0/0.0.0.0

- Service Port: 0

- Type: Performance L4

- Protocol: All Protocol

- Enable on: VLAN 1 (external)

Go_out_server:

- Destinations: Network 0.0.0.0/0.0.0.0

- Services port: 0

- Type: Performance L4

- Enable on: VLAN 2 (internal)

Cache Device:

- Caching for HTTP Traffic

- Using Client IP Spoofing feature: This feature allow Cache devices sent HTTP Request to real server with IP address of client.

Multilayer Switch: Redirect traffic:

Rule 1:

- Flow: Vlan 1, ingress

- Source IP address: Subscribers IP address

- Destination port: 80

- Action: Redirect to 233.x.x.229 (BIG-IP SelfIP Vlan external)

Rule 2:

- Flow: Vlan 2, Ingress

- Destination IP address: Subscribers IP address

- Source Port: 80

- Action: Redirect to 233.x.x.229 (BIG-IP SelfIP Vlan external)

And now I have serious problem.

- When Client sent HTTP requset (www.example.com), MS redirect this request to F5. F5 sent to Cache1.

- Cache 1 check itself, if it has content for this request, it return for Client via F5 – This's OK.

- If Cache 1 does not has content, it act as client and sent request to real server (www.example.com) to get data.

- But when using Client IP Spoofing Feature, Cache sent request with source address of Client.

- When Real server reply, it sent packet HTTP response with destination IP is IP address of Client via Internet Router.

Internet Router sent this packet to MS. MS redirect this packet to F5.

At this point. F5 see this package as new request and sent to Cache farm

- IF F5 send this package to Cache1, Cache 1 has content and response to Client correctly.

- IF F5 send this package to Cache 2 or Cache 3, Cache 1 wait to time out for it's connection. And after time out, it send an error response to Client.

That's why our network too slow and has a lot of error sessions.

Please give me an advice to fix this case.

Forum Discussion