For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ucirl_161922's avatar
ucirl_161922
Icon for Nimbostratus rankNimbostratus
Jul 08, 2014

F5 traffic not hitting the default pool

Hi,

 

We're having an issue at the moment with F5 traffic appearing to hit the virtual server but is not being passed to the default pool. The default gateway has been set to the F5 gateway. I have checked ltm - /var/log/ltm logging but there is nothing relating to the issue. Are there are any other logs we could be checking? The config appears to be ok. Any ideas?

 

Thanks in advance.

 

4 Replies

  • can you try tcpdump?

    e.g.

     tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap host x.x.x.x or host y.y.y.y -v
    
    x.x.x.x is client ip
    y.y.y.y is server ip
    
  • You can use tcpdump on your external interface to see if the traffic is going out. If not, you need to check your VS, Pool and node configuration in place.

     

    Start with what traffic is it question; SSL? HTTP? SIP? etc.

     

    Rgds.

     

  • If I may add, this almost always relates to a routing or configuration issue. Assuming you've purposefully applied the pool to the VIP, and that you see traffic arriving at the VIP, then you should be looking at routing.

     

    1. Does the BIG-IP have a route to the server? If not in a local subnet, does the BIG-IP have a route established to tell it how (gateway, VLAN, interface) it should travel to get to the server.

       

    2. If in a local subnet, does the BIG-IP have a self-IP on that subnet?

       

    3. If you TCPDUMP on the various VLANs, do you see the traffic attempting to leave but potentially go unanswered? If you never see it leave the box, then you can almost assume a routing issue (the BIG-IP doesn't know at all how to get there).

       

    4. If you see the traffic leave the box, what source address does it use? If not a local SNAT address, is it something that the server can route directly to?

       

  • Thanks so much for your responses. It does appear to be a routing issue. The tcpdump command confirmed this however we are still trying to establish why. Thanks again. Your responses have been very helpful.