F5 communication with pool members

Yes you can.  The trick is the BIG-IP instance needs to have network routes to tell it how to get to those servers that are not in one of its networks.  So you could have a network route that says 10.0.0.1/24 goes via 10.0.1.1 network.

David Larsen

I would also point that in your design you'll very likely need to use Source NAT in the Virtual Server.

That may introduce some issues regarding original client IP information loss (it would disappear from L3 headers). In HTTP traffic this is usually circumvented using the X-Forwarded-For header, but if you can use any similar technique really depends on the protocol in question.

The preferred design is getting your F5 box between the router and the servers, and making F5 the default gateway of said servers. This would ensure that return traffic will always get through F5, and a clean routing design doesn't need "tricks" like Source NAT or PBR.

/Mike/

Indeed. 😊 If it works, it works.

If given the chance I'll always go for routed design over one-arm. But besides being a "personal" preference, I mentioned the routed design because it is a way to avoid source NAT. Knowing the full details about the application you want to serve is the key.

/Mike/

Yep that'll work just fine. You can load balance to anything reachable from BIG-IP, and if wanting symmetric traffic delivery for ingress and egress, that the servers have routes back to BIG-IP. Just be aware that edge FW is going to be doing a lot of transit work.

Yes that is how it is intended to be.

Just set the routes to your inside network like 10.0.0.0/8 to the gateway on your inside interface and the default 0.0.0.0 to your outside interface 172.16.1.XY (Gateway). In our setup we have two connections between firewall and f5 thats outside and inside and with that routes ur good to go

Lots of answer, i'll add mine to the mix as well.

When implementing the F5, I made sure the F5 had an interface all the destination pools vlans.  But I wasn't ready to make it the DGW for everything, so I have SNAT and implemented XFF header

My thoughts where.

I have a PA out the front that routes to the F5 (yes I know I could place it out front but). If I want I decrypt and inspect traffic on the inboud by the PA, but the F5 has ASM and WAF as needed.

I could if I wanted to push F5 -> pool server via the PA - and have designed to allow that for some occassions - for the front end servers, that way I can get F5 ASM and PaloAlto Security looking at the traffic. Not in place by default because of the latency vs the threat.  But its there if needed.