Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

MR_Freddy_31338's avatar
MR_Freddy_31338
Icon for Nimbostratus rankNimbostratus
Jul 04, 2018

Change from One ARM to DGW mode

Our deployment now is one Arm by using SNAT AutoMAP , the VS and Pool members on the same subnet but the clients are in different subnet ... We have only one Self IP in the same subnet of Pool member...
application delivery
LTM
Andy_McGrath's avatar
Andy_McGrath
Icon for Cumulonimbus rankCumulonimbus
Jul 06, 2018

If you intend to have the F5 act as a router/firewall type device in front of all your servers and you do not want to use SNAT, so the servers see the client IP address in requests, then you need to do the following:

 

  1. Configure at least two VLANs, one clientside and one serverside.
  2. Configure either a single IP Forwarding Virtual Server with a destination of 0.0.0.0:* or configure an IP Forwarding Virtual Server per VLAN you want to route via.
  3. Ensure all backend Servers to client traffic routes via the F5, via the appropriate Self IP or IP Forwarding Virtual Server destination IP.
  4. Configure Virtual Servers to listen on the clientside VLAN/VLANs

The most important thing in this setup is to ensure the routing via the F5 in the rest of your network and servers is correct.

 

Also in this type of setup remember your F5 is also going to be the routing device for the backend servers, at least to/from some client subnet, and so recommend reviewing a few areas:

 

  • F5 AFM - F5's firewall module, if you have it licensed recommend enabling it and using it to provide some ACL/firewall protection.
  • Review your HA/redundancy setup, as you could end up with all access to the servers routing via the F5 you don't want to find during a failover it takes a long time for traffic to start routing correctly.
    • Look at your Traffic Group failover method, recommend HA Groups
    • If using MAC Masquerade will help or hinder failover in your environment
  • If you have multiple switches connected to the F5 you may need to review your Spanning Tree and see if the F5 needs to be part of it (STP can be a pain with an F5)

My final point, make sure this is the solution you need because the applications you a delivering via the F5 need to see the Client IP in the network packet (not just in some HTTP header) and/or you want to use the F5 for as a network firewall/router for security etc. Remember this will turn your application delivery F5 device into a router and application delivery F5 device so resource will be taken up by routing etc. instead of doing it primary purpose of app delivery.

 

Hope this helps in someway