For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cawong23_136311's avatar
cawong23_136311
Icon for Altostratus rankAltostratus
Jan 09, 2018

F5 wildcard outgoing with default gateway pool issue

Hi F5 guys,   I configured a wildcard outgoing VS for internal user outgoing traffic, the VS has a gateway pool with ISP A and ISP B gateway address.   However, I found the outgoing always rel...
BIG-IP
LTM
security
swjo_264656's avatar
swjo_264656
Icon for Cirrostratus rankCirrostratus
Jan 13, 2018

Hi

 

In your case, It seems that ISP bgp setting seems to wrong.

 

but If ping dst IP is belong to just one ISP, dst unreachable is expected result.

 

First, ping to google(belong to lots of ISP), unplug one ISP, stop ping and retry ping.

 

Second, check ISP`s bgp hold time. -> normally long as you expected.

 

thank you.

 

  • cawong23_136311's avatar
    cawong23_136311
    Icon for Altostratus rankAltostratus
    Jan 19, 2018

    I opened tech case, it seems the normal behavior on F5.

     

    It looks you kept the ping tool running all the time. This should not exist if you stop the command and then run it again after 10 seconds. This is due to that even for ICMP traffic, there will be a connection established in connection table. The entry in the connection table won't be removed even if the member is down.

     

    That's ok just need to explain to customer.