For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ajit's avatar
Ajit
Icon for Altostratus rankAltostratus
Jun 29, 2014

Can we configure same members in different VIP's

Currently i have one VIP which has 2 members in its pool. The members are 192.168.0.22:443 & 192.168.0.23:443. The IP of my VIP is a private IP address and the NAT translation happens on the firewall...
application delivery
LTM
nitass's avatar
nitass
Icon for Employee rankEmployee
Jun 29, 2014

e.g.

 config

root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm virtual bar1
ltm virtual bar1 {
    destination 172.28.24.201:80
    ip-protocol tcp
    mask 255.255.255.255
    pool foo
    profiles {
        http { }
        tcp { }
    }
    source 0.0.0.0/0
    source-address-translation {
        type automap
    }
    vs-index 44
}
root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm virtual bar2
ltm virtual bar2 {
    destination 172.28.24.202:80
    ip-protocol tcp
    mask 255.255.255.255
    pool foo
    profiles {
        http { }
        tcp { }
    }
    source 0.0.0.0/0
    source-address-translation {
        type automap
    }
    vs-index 45
}
root@(ve11a)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm pool foo
ltm pool foo {
    members {
        200.200.200.101:80 {
            address 200.200.200.101
        }
    }
}

 trace

[root@ve11a:Active:In Sync] config  tcpdump -nni 0.0 -s0 port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on 0.0, link-type EN10MB (Ethernet), capture size 65535 bytes

// bar1

12:25:16.007296 IP 172.28.24.1.38806 > 172.28.24.201.80: S 1487006438:1487006438(0) win 5840  in slot1/tmm0 lis=
12:25:16.007383 IP 172.28.24.201.80 > 172.28.24.1.38806: S 521107622:521107622(0) ack 1487006439 win 4380  out slot1/tmm0 lis=/Common/bar1
12:25:16.021530 IP 172.28.24.1.38806 > 172.28.24.201.80: . ack 1 win 5840  in slot1/tmm0 lis=/Common/bar1
12:25:16.023088 IP 172.28.24.1.38806 > 172.28.24.201.80: P 1:157(156) ack 1 win 5840  in slot1/tmm0 lis=/Common/bar1
12:25:16.023246 IP 172.28.24.201.80 > 172.28.24.1.38806: . ack 157 win 4536  out slot1/tmm0 lis=/Common/bar1
12:25:16.024639 IP 200.200.200.14.38806 > 200.200.200.101.80: S 2841845909:2841845909(0) win 4380  out slot1/tmm0 lis=/Common/bar1
12:25:16.378735 IP 200.200.200.101.80 > 200.200.200.14.38806: S 533865806:533865806(0) ack 2841845910 win 5792  in slot1/tmm0 lis=/Common/bar1
12:25:16.378767 IP 200.200.200.14.38806 > 200.200.200.101.80: . ack 1 win 4380  out slot1/tmm0 lis=/Common/bar1
12:25:16.378788 IP 200.200.200.14.38806 > 200.200.200.101.80: P 1:157(156) ack 1 win 4380  out slot1/tmm0 lis=/Common/bar1
12:25:16.584536 IP 200.200.200.101.80 > 200.200.200.14.38806: . ack 157 win 6432  in slot1/tmm0 lis=/Common/bar1
12:25:23.780423 IP 200.200.200.101.80 > 200.200.200.14.38806: P 1:244(243) ack 157 win 6432  in slot1/tmm0 lis=/Common/bar1
12:25:23.780494 IP 172.28.24.201.80 > 172.28.24.1.38806: P 1:244(243) ack 157 win 4536  out slot1/tmm0 lis=/Common/bar1
12:25:23.780503 IP 200.200.200.14.38806 > 200.200.200.101.80: . ack 244 win 4623  out slot1/tmm0 lis=/Common/bar1
12:25:23.782055 IP 172.28.24.1.38806 > 172.28.24.201.80: . ack 244 win 6432  in slot1/tmm0 lis=/Common/bar1
12:25:23.782329 IP 172.28.24.1.38806 > 172.28.24.201.80: F 157:157(0) ack 244 win 6432  in slot1/tmm0 lis=/Common/bar1
12:25:23.782329 IP 172.28.24.201.80 > 172.28.24.1.38806: . ack 158 win 4536  out slot1/tmm0 lis=/Common/bar1
12:25:23.782329 IP 200.200.200.14.38806 > 200.200.200.101.80: F 157:157(0) ack 244 win 4623  out slot1/tmm0 lis=/Common/bar1
12:25:23.849842 IP 200.200.200.101.80 > 200.200.200.14.38806: . ack 158 win 6432  in slot1/tmm0 lis=/Common/bar1
12:25:24.382187 IP 200.200.200.101.80 > 200.200.200.14.38806: F 244:244(0) ack 158 win 6432  in slot1/tmm0 lis=/Common/bar1
12:25:24.382248 IP 200.200.200.14.38806 > 200.200.200.101.80: . ack 245 win 4623  out slot1/tmm0 lis=/Common/bar1
12:25:24.382260 IP 172.28.24.201.80 > 172.28.24.1.38806: F 244:244(0) ack 158 win 4536  out slot1/tmm0 lis=/Common/bar1
12:25:24.383288 IP 172.28.24.1.38806 > 172.28.24.201.80: . ack 245 win 6432  in slot1/tmm0 lis=/Common/bar1

// bar2

12:25:35.223999 IP 172.28.24.1.60353 > 172.28.24.202.80: S 383028358:383028358(0) win 5840  in slot1/tmm1 lis=
12:25:35.224070 IP 172.28.24.202.80 > 172.28.24.1.60353: S 3453733638:3453733638(0) ack 383028359 win 4380  out slot1/tmm1 lis=/Common/bar2
12:25:35.225749 IP 172.28.24.1.60353 > 172.28.24.202.80: . ack 1 win 5840  in slot1/tmm1 lis=/Common/bar2
12:25:35.225923 IP 172.28.24.1.60353 > 172.28.24.202.80: P 1:157(156) ack 1 win 5840  in slot1/tmm1 lis=/Common/bar2
12:25:35.225985 IP 200.200.200.14.60353 > 200.200.200.101.80: S 3760426868:3760426868(0) win 4380  out slot1/tmm1 lis=/Common/bar2
12:25:35.225993 IP 172.28.24.202.80 > 172.28.24.1.60353: . ack 157 win 4536  out slot1/tmm1 lis=/Common/bar2
12:25:35.305729 IP 200.200.200.101.80 > 200.200.200.14.60353: S 1256281240:1256281240(0) ack 3760426869 win 5792  in slot1/tmm1 lis=/Common/bar2
12:25:35.305756 IP 200.200.200.14.60353 > 200.200.200.101.80: . ack 1 win 4380  out slot1/tmm1 lis=/Common/bar2
12:25:35.305775 IP 200.200.200.14.60353 > 200.200.200.101.80: P 1:157(156) ack 1 win 4380  out slot1/tmm1 lis=/Common/bar2
12:25:35.318241 IP 200.200.200.101.80 > 200.200.200.14.60353: . ack 157 win 6432  in slot1/tmm1 lis=/Common/bar2
12:25:36.095816 IP 200.200.200.101.80 > 200.200.200.14.60353: P 1:244(243) ack 157 win 6432  in slot1/tmm1 lis=/Common/bar2
12:25:36.095872 IP 172.28.24.202.80 > 172.28.24.1.60353: P 1:244(243) ack 157 win 4536  out slot1/tmm1 lis=/Common/bar2
12:25:36.095881 IP 200.200.200.14.60353 > 200.200.200.101.80: . ack 244 win 4623  out slot1/tmm1 lis=/Common/bar2
12:25:36.097815 IP 172.28.24.1.60353 > 172.28.24.202.80: . ack 244 win 6432  in slot1/tmm1 lis=/Common/bar2
12:25:36.098165 IP 172.28.24.1.60353 > 172.28.24.202.80: F 157:157(0) ack 244 win 6432  in slot1/tmm1 lis=/Common/bar2
12:25:36.098186 IP 172.28.24.202.80 > 172.28.24.1.60353: . ack 158 win 4536  out slot1/tmm1 lis=/Common/bar2
12:25:36.098194 IP 200.200.200.14.60353 > 200.200.200.101.80: F 157:157(0) ack 244 win 4623  out slot1/tmm1 lis=/Common/bar2
12:25:36.106357 IP 200.200.200.101.80 > 200.200.200.14.60353: F 244:244(0) ack 158 win 6432  in slot1/tmm1 lis=/Common/bar2
12:25:36.106393 IP 200.200.200.14.60353 > 200.200.200.101.80: . ack 245 win 4623  out slot1/tmm1 lis=/Common/bar2
12:25:36.106402 IP 172.28.24.202.80 > 172.28.24.1.60353: F 244:244(0) ack 158 win 4536  out slot1/tmm1 lis=/Common/bar2
12:25:36.108395 IP 172.28.24.1.60353 > 172.28.24.202.80: . ack 245 win 6432  in slot1/tmm1 lis=/Common/bar2
nitass's avatar
nitass
Icon for Employee rankEmployee
Jun 29, 2014
snat is not needed as long as pool member sends return traffic to bigip (e.g. bigip is its default gateway). in my lab, pool member default gateway is not bigip. so, i have to enable snat automap.