For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

danielng_19608's avatar
danielng_19608
Icon for Nimbostratus rankNimbostratus
Oct 20, 2009

Having multiple self-ips

Hi guys,

 

 

this is the scenario, my F5 LTM 6400 has two self-ips(eg, 192.168.1.10 and 10.10.1.10)

 

 

My log server ip address is 10.10.1.200

 

The gateway configured for this device is 192.168.1.1.

 

 

Whenever i do a SCP to my log server, i am seeing that it is using the 192.168.1.10 IP to initiate the connection. I am assuming that it is using the 192.168.1.10 IP because of the gateway configured. Is there a way to initiate the connection to my log server using the 10.10.1.10 IP? Will adding a secondary gateway help? Thanks!!!

 

 

config
design

5 Replies

  • Anthony_7417's avatar
    Anthony_7417
    Historic F5 Account
    Nov 10, 2009
    And what are the netmasks on those self-IPs, too?

     

    And these are definitely self-IPs, right? (not the management address)
  • danielng_19608's avatar
    danielng_19608
    Icon for Nimbostratus rankNimbostratus
    Dec 21, 2009
    Sorry for the late reply all,

     

     

    Bhattman: No, the 2 IPs belong to different VLANs.

     

     

    Anthony: Yup the IPs are the Self-IPs of the box. Not the management. The n/w mask for each respective segment is a /24.

     

     

    My thinking is because of the gateway configured on the device as 192.168.1.1, it uses 192.168.1.10 to initiate the connection since they belong to the similar subnet. Advise pls??

     

     

    Thanks!!
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Dec 22, 2009
    I haven't tried, but it's possible you could configure a SNAT'ed VS for the log traffic. Then point all the logs at the VS and do what you like with the src IP.
  • L4L7_53191's avatar
    L4L7_53191
    Icon for Nimbostratus rankNimbostratus
    Dec 28, 2009
    If the log server and the BigIP are adjacent to one another at layer 2 (and it looks like they most definitely are), you absolutely should see the traffic sourced from the 10.10.1 network. The default router shouldn't come into play here at all, assuming that the network configuration on the BigIP is in order.

     

     

    Here are some questions:

     

    1) What version are we talking about here? I've run into something similar on OLD code (version 4.x stuff), but nothing recent.

     

    2) What does your arp table look like? Do "b arp show", then to an "arp -a". Compare the two outputs. Do the same thing on your log host - you should see the MAC address of the BigIP for 10.10.1.10

     

    3) Could you paste a (very small) tcpdump of the traffic that shows your log host seeing traffic sourced from the 192.168 address?

     

    4) Are these SCP sessions actually working somehow? I would assume not(hope?), but it's not clear above.

     

     

    -Matt