For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

danielng_19608's avatar
danielng_19608
Icon for Nimbostratus rankNimbostratus
Oct 20, 2009

Having multiple self-ips

Hi guys,     this is the scenario, my F5 LTM 6400 has two self-ips(eg, 192.168.1.10 and 10.10.1.10)     My log server ip address is 10.10.1.200   The gateway configured for ...
config
design
L4L7_53191's avatar
L4L7_53191
Icon for Nimbostratus rankNimbostratus
Dec 28, 2009
If the log server and the BigIP are adjacent to one another at layer 2 (and it looks like they most definitely are), you absolutely should see the traffic sourced from the 10.10.1 network. The default router shouldn't come into play here at all, assuming that the network configuration on the BigIP is in order.

 

 

Here are some questions:

 

1) What version are we talking about here? I've run into something similar on OLD code (version 4.x stuff), but nothing recent.

 

2) What does your arp table look like? Do "b arp show", then to an "arp -a". Compare the two outputs. Do the same thing on your log host - you should see the MAC address of the BigIP for 10.10.1.10

 

3) Could you paste a (very small) tcpdump of the traffic that shows your log host seeing traffic sourced from the 192.168 address?

 

4) Are these SCP sessions actually working somehow? I would assume not(hope?), but it's not clear above.

 

 

-Matt