Forum Discussion

Mike_61640's avatar
Mike_61640
Icon for Nimbostratus rankNimbostratus
Sep 03, 2012

Creating VS for a network not directly connected

Hi,

 

I have a network that has a DMZ (10.1.1.0/24) and an Internal (10.2.2.0/24) network directly connected to the F5 LTM. The Internal network also has access to other networks (172.16.0.0/24) across a VPN tunnel. I need to create a Virtual Server on the DMZ that allows traffic to specific servers that are on 172.16.0.0/24 network.

 

 

I may have my information wrong, but if I just create a Forwarding(IP) Virtual Server for 172.16.0.0/24:* on all ports and assign it to the DMZ vlan, will it listen for incoming traffic on the DMZ interface for the 172 network? I think I read that if the F5 doesn't have a Self IP for that network, it won't ARP that network. Coming back I have a default Forwarding (IP) Virtual Server allowing access from Internal to DMZ (0.0.0.0/0:*). I also have routes in the F5 that point 172.16.0.0/24 traffic to the Internal network.

 

Either way I'm having issues with traffic going from the DMZ across the tunnel. Any help is appreciated.

 

Thanks,

 

Mike

 

config
design
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Sep 04, 2012
    you have added a route for 172.16.0.0/24 subnet on firewall to send traffic to bigip's dmz interface, haven't you?

     

     

    have you run tcpdump on bigip? did you see any incoming packet to 172.16.0.0/24 subnet?

     

     

    e.g.

     

    tcpdump -nni 0.0 net 172.16.0.0/24
  • Thomas_Schocka1's avatar
    Thomas_Schocka1
    Icon for Altocumulus rankAltocumulus
    Sep 04, 2012
    Hi Mike,

     

     

     

    You need to check the following items:

     

    - does the F5 have a route to the 172.16.0.0/24 subnet?

     

    - does the F5 have a Forwarding (IP) type Virtual Server for this network?

     

    - is the Forwarding (IP) Virtual Server for this 172.16.0.0/24 network enabled on all VLAN's that will be using the F5 as a router for this network?

     

    - do the servers know they have to route packets for this network to the F5? (e.g. do they have the necessary routes?)

     

    - if it's not the servers directly, does the firewall or router know how to find the F5 on this network?

     

    - have you checked for any asymmetric routing between the servers in DMZ and those behind it? (e.g. packets go over the F5 but might return through the firewall because the destination server doesn't have a route back to the F5 directly)

     

     

    Kind regards,

     

     

    Thomas
  • Mike_61640's avatar
    Mike_61640
    Icon for Nimbostratus rankNimbostratus
    Sep 04, 2012
    I went through and checked everything listed in your comments and they all seem to be in order. I have static routes for these networks and a Forwarding (IP) setup for the 172.16.0.0/24. I guess I just wanted to make sure that it would grab allow/grab this traffic if these networks were not directly connected. I know that standard VS's don't and wanted to confirm that the Forwarding (IP) VS didn't act the same way.

     

     

    It still may be their application, I'm going to run more tcpdumps and see if I can find the problem.

     

     

    Thanks for the help,

     

    Mike