For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mattia_59070's avatar
Mattia_59070
Icon for Nimbostratus rankNimbostratus
Sep 13, 2014

F5 LTM Sending ACK to a RST,ACK on its own with only routing+nat configured

Hi, we have seen this strange behavior when troubleshooting a network problem. We have a F5 acting only as router-nat for a particular flow, the LTM has 2 interfaces, the source is in a subnet and we...
BinaryCanary_19's avatar
BinaryCanary_19
Historic F5 Account
Sep 14, 2014

If you are using a Forwarding-IP Virtual server or a FastL4 Virtual server, then the F5 is generally not going to be generating any packets.

 

You should look at the Source MAC of the incoming packet and trace which device is generating it.

 

BinaryCanary_19's avatar
BinaryCanary_19
Historic F5 Account
Sep 14, 2014
I will actually have to test to be sure if a simple NAT is stateful, my guess would be "partially". It would be stateful in that it will simply discard packets that obviously don't match the flow (for TCP, this would be things like invalid sequence or ack numbers), but even at this, I don't think the LTM will send RST packets on it's own. It normally silently drops mismatched packets, or they get handled by some other listener/policy on the box.