For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

newf5learner's avatar
newf5learner
Icon for Nimbostratus rankNimbostratus
Sep 05, 2016

F5 mac masquerade on traffic group - traffic processing failed

Hi,

 

I have a standalone LTM and I was testing the HA features, I have configured the MAC masquerade on the ttraffic group1 (only one traffic group is available).. I tried to access the VIPs configured on the LTM and I couldnt access any of them.. I'm not sure with the reasons. How is the MAC masquerade address on the traffic group impacting the traffic processing for the VIP? The moment I removed the MAC masquerade, it started working.. can someone make me understand the logic behind this please.

 

Im on version 11.6.0 HF 5..

 

thanks.

 

application delivery
LTM
TMOS

2 Replies

  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Sep 05, 2016

    Did you configure a MAC masquerade address and a floating IP ? Floating IP will be associated with the MAC masquerade address.

     

    SOL13502

     

  • Henrik_S's avatar
    Henrik_S
    Icon for Nimbostratus rankNimbostratus
    Sep 05, 2016

    Was it by any chance a virtual LTM? If so, you must configure the port group or equivalent to accept forged MAC transmits, mac address change and promiscious mode.

     

    MAC masquerade means in basic that the same virtual MAC address will be shared between two systems in HA. This however requires upstream units as switches, vswitches and port groups to both allow allow a MAC address to change and that a given interface will send "forged" transmits with the mac masquerade address for traffic passing through that traffic group.