Forum Discussion
Olayinka-F5LB
Altocumulus
AltocumulusF5 communication with pool members
Hello community, Is it possible for an F5 to load balance traffic to pool members in a network segment if it doesn't have a self-IP in that network segment? **Please refer to the diagram attached**...
AlexS_yb
Cirrocumulus
CirrocumulusLots of answer, i'll add mine to the mix as well.
When implementing the F5, I made sure the F5 had an interface all the destination pools vlans. But I wasn't ready to make it the DGW for everything, so I have SNAT and implemented XFF header
My thoughts where.
I have a PA out the front that routes to the F5 (yes I know I could place it out front but). If I want I decrypt and inspect traffic on the inboud by the PA, but the F5 has ASM and WAF as needed.
I could if I wanted to push F5 -> pool server via the PA - and have designed to allow that for some occassions - for the front end servers, that way I can get F5 ASM and PaloAlto Security looking at the traffic. Not in place by default because of the latency vs the threat. But its there if needed.
buulam
Admin
AdminCommon design as well! Good to keep in mind for Virtual Edition deployments where the licensing is by throughput, also.