F5 LTM as Reverse Proxy

Yes it's feasable, but why are you NAT'ing so many times*? Is there a problem with your network numbering? Supporting legacy addresses where people haven't configured things correctly?

 

 

One thing I would note is that I'd normally configure the F5 directly in front of the servers. (Usually by moving the serves to a DMZ behind the F5's). The internal firewall doesn't seem to be gaining you anything... (** Assuming this is a new requirement and not simply a new requirement to load balance existing internal only servers from external).

 

 

e.g.

 

 

Internet -> Firewall -> (F5 -> Servers) all in a DMZ.

 

 

or

 

 

Internet -> Ext Firewall

 

\

 

F5 -> DMZ with Servers

 

/

 

Internal -> Internal Firewall

 

 

(So the F5 becomes the router to/from your DMZ's).

 

 

 

 

More info as to your reasoning & what can or can't be altered may help...

 

 

 

H

 

 

* - I don't adhere to the commonly mis-stated view that NAT'ing is automatic security...