F5/ISA/Exchange

We are testing ISA as well behind two LTMs. Here's what I sent to F5...

 

"When using LTM to communicate with Microsoft ISA servers, need to override Auto Last Hop(?) with a static ARP entry? This is because the ISA servers also load balance between themselves and use a virtual MAC. Traffic originating from inside the ISA firewalls come to the LTM with a local MAC address, but the ISA's expect the response to use the virtual MAC address. Our alternatives are to code one static entry for each ISA IP address, or turn off Auto Last Hop. We are not sure we want to turn Auto Last Hop off, due to possible SNAT problems(?). "

 

Traffic that originates from the outside works fine because the Big IP uses the virtual MAC. Any comments?