jpeterson6
Aug 06, 2015Nimbostratus
Help with configuring F5 load-balancing in between two ASA pairs (full routing)
Hello,
I'm fairly new to F5s, and from what I've been seeing in my searches it appears as though I've really dived into the deep end for complex F5 setups. I've been spending time researching my issues but so far haven't been able to find the specific answers I need.
Topology Details:
Route Path:
Internet <--> External ASA <--> F5 <--> Nexus 5k <--> Internal ASA <--> Server DMZs
External ASA:
- inside IP is 172.16.0.1/24
- Performs Static NAT from public IPs to VS IPs
F5:
- external VLAN (172.16.0.0/24) attached to external LACP trunk, tagged
- internal VLAN (10.99.0.0/24) attached to internal LACP trunk, tagged
- default gateway points to 172.16.0.1/24
- internal gateway (10.0.0.0/8) points to 10.99.0.10/24
- self-ip (float) 10.99.0.1/24
- All VS on 172.16.0.0/24
- nodes on multiple 10.x.x.x/24 subnets
Nexus5k:
- 'outside' IP is 10.99.0.10/24
- default gateway points to 10.99.0.1/24
Internal ASA:
- default gateway points to Nexus5k
- All load-balanced servers behind ASA on different security zones/interfaces
- No NAT
Notes:
- Active/Standby HA using an HA VLAN on Internal trunk.
- The gateway of the servers must be the internal ASA.
- The topology cannot be changed.
Questions:
- Will I need any SNATs in this setup? The routing should technically take care of everything so I'm not seeing much purpose in SNATs based on my understanding of how it works.
- I already set up an IP forwarding server (source/destination of 0.0.0.0/0) to allow OUTBOUND (server initiated) routing to pass through the F5; I have enabled loose initiation/close and disabled 'reset on timeout' using an attached custom FastL4 profile. Will I need any special forwarding servers or other virtual servers outside of Standard to make this work for INBOUND connections?
- Are there any other details I need to consider that I haven't mentioned here?