For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

yammy1688_99834's avatar
yammy1688_99834
Icon for Nimbostratus rankNimbostratus
Jun 30, 2011

Can remote ltm VS as a node?

I'm looking to forward traffic going to a VS over to another VS at a remote LTM.

 

 

I've set up the remote VS as its own node and pool (on the local LTM), and enabled autoSNAT, but it just hangs when attempting to open in a browser.

 

 

 

I have confirmed that traffic is sourced from the self-ip on the outbound vlan.

 

 

 

Seems pretty straightforward, but I can't get it going for some reason. Any help is appreciated.

 

 

 

Thanks,

 

 

 

-Ken

 

config
design

4 Replies

  • The_Bhattman's avatar
    The_Bhattman
    Icon for Nimbostratus rankNimbostratus
    Jun 30, 2011
    Hi Ken,

     

    Have you checked to see if that source IP is reaching the remote VS at the remote LTM?

     

     

     

    Bhattman

     

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Jun 30, 2011
    Yeah.

     

     

    tcpdump is your friend in all cases.

     

     

    Perform a tcpdump at each point (i.e. the local LTM and the remote LTM) looking for the bi-directional traffic (Should be easy. Sounds like a SYN/ACK isn't getting back). Possibly your remote LTM doesn't have a route back to the self-ip? Or the remote LTM isn't doing SNAT and you don't have a route back from the poolmember to the local SNAT via the remote F5?

     

     

    H
  • yammy1688_99834's avatar
    yammy1688_99834
    Icon for Nimbostratus rankNimbostratus
    Jul 05, 2011
    Hey guys,

     

     

    looks like it was as simple as setting up a egress snat pool. turns out it wasn't using the right IP when using autosnat.

     

     

    Thanks all!
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jul 05, 2011
    Thanks for posting the solution. It sounds like there wasn't a floating self IP on the egress VLAN:

     

     

    sol7336: The SNAT Automap feature may use an unintended self IP address

     

    http://support.f5.com/kb/en-us/solutions/public/7000/300/sol7336.html

     

     

    Aaron