For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Pete_L_112517's avatar
Pete_L_112517
Icon for Nimbostratus rankNimbostratus
Mar 19, 2014

Can ping Self-IPs but cannot ping VirtualIPs

We've set up a new interface for internal load balancing on our BIG-IP 3600s.

 

New VLAN created, added correct VLAN tag, assigned to an interface, added a new route for our internal server subnet.

 

We can ping the SelfIP of both devices in HA and the floating IP address for that VLAN, but we cannot ping any virtual server IP addresses.

 

We can ping the nodes from the appliances and the health monitors return the nodes as healthy. Not using SNAT or automap. No ACL's, no connectivity profiles. We've stripping the Virtual Servers down as to basic as possible.

 

However, we're stuck as to why the VirtualIP addresses cannot be pinged.

 

Routing on our core router for that subnet is setup correctly, according to network engineer.

 

We're wondering if its a return path isssue? But we've run tcpdump and can't see any connections to the Virtual IP, but can see traffic to the self ip addresses.

 

Ideas where to look next? Thanks guys.

 

application delivery
availability
BIG-IP Access Policy Manager (APM)
deployment
design
LTM
security

1 Reply

  • Patrik_Jonsson's avatar
    Patrik_Jonsson
    Icon for MVP rankMVP
    Mar 19, 2014

    Hi!

    I was gonna suggest this:

    Does the virtual servers listen to the VLAN you send ICMP on?

Does the "virtual address" have ICMP enabled (check the virtual address part of the virtual server list).

    But then I saw that you do not see any result when using tcp-dump to send ICMP to the virtual servers. Are some of the self IP's you refer to located on the same network as the virtual server network? Otherwise there might be a route missing to the virtual server network in the router.

    /Patrik